Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Monitoring Server in a Workgroup - Failure Audits

Hello,

We are trying to use APM to monitor IIS on a server in a workgroup. I setup the credentials properly as "WORKGROUP\username" and the tests succeed (I have also tried just using the USERNAME without the workgroup and the tests succeed too).

The issue is that when I run the tests (or when the APM is scheduled to check the IIS monitors) it creates TONS of failure audits in the security logs on the monitored server. It appears that Orion APM is trying to first authenticate itself with the IIS server using domain credentials. Is there anyway to stop this?

Thank you in advance!

Find more posts tagged with

Accepted answers

All comments

smargh

Use computername\username, not workgroup\username.

rudicd

Sorry - that is what I meant I used....

I did try COMPUTERNAME\USERNAME, however it still continues to give all of these failure audits on the monitored server.

Any other ideas?

martin.susil

Do you know which particular component type is causing that? To find out, could you unmanage all applications on that server so APM will stop polling it temporarily. Then go to IIS application edit page, try to test each individual component type and after each test check if event was created?

rudicd

I only have two IIS components set for this workgroup server. They are "IIS Admins Service" and "World Wide Web Publishing Service".

When I click the "Test" button for both, they come back successfull (green bar) however both components create a TON of failure audit events in the security log. Have you seen this before?

martin.susil

We have seen something similar (but probably not exactly the same) and it was resolved when customer applied this hotfix: http://support.microsoft.com/kb/974893

Other thing that comes to my mind is that if you are using Windows Service Monitor in WMI mode (it's possible to set this option on Application Edit page in APM 4.0.2 and later), you can try to switch it to RPC and see if it makes any difference.