Security Log Audit Failures on Monitored Server

Using APM 5.2 to monitor a Windows 2003 R2 server, and seeing some peculiar behaviour... I'm using SNMP and a domain account that is a local admin on the server I am monitoring. However every few minutes, I see a series of audit failures in the security log of the Windows server, coming from my monitoring server (identified in the events by its IP address). Event ID 529, Logon/Logoff, the reason listed in each event as a Logon Failure, "Unknown user name or bad password". The source port of the failure seem to be a variety of ports in the 6000 range. The server is coming back fine in the monitoring software, and all the applications I'm monitoring are listed as being up and available, so the monitor seems to be working fine, but it is filling up the security log of the client server with these bad logon attempts for some reason. Hoping someone has an idea as to what might be the issue.

Thanks,

Tom F.

Find more posts tagged with

application_performance_monitor

SNMP

solarwinds

apm

microsoft

Windows

Accepted answers

lukas.belza

Hello,

This problem is related to monitoring through WMI and occurs when a target node is non-domain computer. We've opened the ticket with Microsoft (ticket number 112083058194920) and here is the answer from Microsoft support:

I studied the problem and I see that it happens only for domain-workgroup scenario or workgroup-workgroup scenario. I consulted with our escalation after making a repro and they told that this is a known bug since Windows Vista which should have been fixed in Windows 8 (and Windows Server 2012).
If Process running as A\U1 in machine A tries to connect to machine B using B\U2 user credential. In machine B, we see a security failure audit log for “A$”. When connecting through WMI to another remote server/client, passthrough authentication is always attempted even if specific credentials are specified in the tool being used. So as the only drawback of such process is unnecessary events in Audit Event log it was decided to move fixing of this problem to Windows 8.
There is no workaround for now.
This is not bug in SolarWinds code but in Windows itself.

Unfortunately we can't do anything with this problem.

Thanks,

Lukas Belza (SolarWinds development)

All comments

aLTeReGo

Have you applied the following Microsoft hotfix to your Orion server?

http://support.microsoft.com/kb/974893

lukas.belza

Hello,

I studied the problem and I see that it happens only for domain-workgroup scenario or workgroup-workgroup scenario. I consulted with our escalation after making a repro and they told that this is a known bug since Windows Vista which should have been fixed in Windows 8 (and Windows Server 2012).
If Process running as A\U1 in machine A tries to connect to machine B using B\U2 user credential. In machine B, we see a security failure audit log for “A$”. When connecting through WMI to another remote server/client, passthrough authentication is always attempted even if specific credentials are specified in the tool being used. So as the only drawback of such process is unnecessary events in Audit Event log it was decided to move fixing of this problem to Windows 8.
There is no workaround for now.
This is not bug in SolarWinds code but in Windows itself.

Unfortunately we can't do anything with this problem.

Thanks,

Lukas Belza (SolarWinds development)

tfoster2501

So if I understand correctly, it will monitor the server without issue, but it will add those audit entries to the security log?

lukas.belza

Yes, the target machine is monitored successfully but Orion generates these Failure Audit events in the Security event log on target machine.