On all Windows nodes managed by my solarwinds server, i am seeing failed security events for logons from ./administrator and ./Administrator. I am trying to find what the cause of this is
When you say "Managed by" what do you mean? ie: What modules are you using? How are they being monitored/managed, via an agent, or via something like WMI? Are they all using the same credentials? Do the credentials have administrator or Administrator in them? Are you doing any API polling of the server or the application on it? Do you know for sure that the login's are coming from the Solarwinds server?
So many questions, so few details…
What modules are you using?
How are they being monitored/managed, via an agent, or via something like WMI?
Are they all using the same credentials?
Do the credentials have administrator or Administrator in them?
Are you doing any API polling of the server or the application on it?
Do you know for sure that the login's are coming from the Solarwinds server?
I'd be checking the source IP in the 4625 events first. If the failed logons are coming from the SolarWinds server itself and occur on a regular polling schedule, it's likely a stale or incorrect credential configured in Orion (WMI, WinRM, Discovery, or the Credential Library).
It is coming from the SolarWinds server, and the weird part is it's not regular. It will sometimes happen multiple times a day, and sometimes have days in between events. I checked all my credentials in WMI and Credential Library. I don't have WinRM or Discovery configured at all. Is there a place I can check in the SQL Database on the SolarWinds server? Thanks for your help!
