Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Security Alarm

Our security department is reporting an error on their IPS system related to Orion. I am not sure where to look for the answer, so I am hoping someone can point me in the right direction.

They are logon failures from the Orion servers Machine Account$ to a couple of the IIS servers on the network. The error states that the "user has not been granted the requested logon type." It is a type 3 login, so network logon. The source port is on an always changing network port in the 3200-3300 range, the 2 I am looking at now are 3289 and 3290.

Any ideas what Orion component would be using the Machine Account to logon?

Thanks Everyone.

Find more posts tagged with

Accepted answers

All comments

neilmborilla

Do you have APM module installed?

Can you post here the screenshot?

Kiemat

I do have APM installed, and there is a User Experence Monitor configured to go to a HTTP address and look for a key word.

As for a screen shot, the error message is showing up on the security IPS system, so I don't have a screen shot, but the core if it is:

AUTHORITY/SYSTEM, Failure Audit, <Target Server Name>, Logon/Logoff, Logon Failure:

Name: <Orion Server Name$> Domain: <Domain>, Logon Type 3, Kerberos Authentication Package, Network Address: <Orion Server Name>, Port 3290

Failed password attempts greater than 5 in 10 minutes.

Valcora

Im seeing the same problems on my servers, but only on the servers in a different domain to the Solarwinds Orion server,

no one have any ideas why the machine account is being used?