Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Domain Account logged in from ::1, everyday at the sametime

I'm trying to find out how/why this audit event is being logged daily at the same time by an account that is disabled in AD, deleted from access within SolarWinds and without a scheduled task logging it in. Does anyone have any idea how this could be happening and how to identify/stop it?

Find more posts tagged with

Accepted answers

d09h

If you look in the database table with accounts in it, do you see a row with the username in question? I would delete that row.

More details: https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Delete_a_row_from_the_database_using_Database_Manager

All comments

d09h

Is there a corresponding entry (same times / dates) in Windows Event Viewer? If so, does it have more details?

pparsaie

I've looked in the Windows Event logs and nothing at the time seems to be relevant.This is odd as its using AD (shows domain\username) and the account within AD is disabled.

Any idea what ::1 would lead to? Home makes sense as in from the Server? IIS?

pratikmehta003

take a look at this if it helps...

localhost - Wikipedia

h.hendriks

You can try http://[::1] or better https://[::1] for the IIS.

::1 is, see answere praktimehta003, .. the localhost.

d09h

If you look in the database table with accounts in it, do you see a row with the username in question? I would delete that row.

More details: https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Delete_a_row_from_the_database_using_Database_Manager

pparsaie

This looked like the fix though its odd that I removed the account via the GUI weeks before. I'll remember to verify the remove action actually removes access via checking the DB for the user account.

d09h

Glad that worked for you.

Mind marking my answer correct pparsaie?

(Looking at that sweet hammock in the Thwack store. I could really use that camping with the scouts, or to collapse in after yard work...)