Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Everyday at the same time all of my Domain Controllers get odd AUTH errors tied to Solarwinds

I am going to try and explain this the best I can. Every day around 3CST all of the DCs generate a bunch of errors for a minute or two and then they go away. They are all referencing my main polling engine's server name - it is not the service account used but the server name.

First Error is Event ID 4776

Second Error is 4625

I am trying to figure out what is going on here. These errors run for a minute or so then they clear up and do not come back until the next day at the same time. Is there something simple I am missing? All of the different domain service accounts work and the error is SERVERNAME$ tried to login. Thanks - Dave

Find more posts tagged with

Comments

Seashore

Strange. A couple of ideas:

Can it be the maintenance job that runs that long? Doing the same thing at about 3?

Do you have a scheduled task running then?

A scheduled report?

jm_sysadmin

Are there events on your Orion server that match?

martian_monster

Thank you both. I will start my checklist and let you know how it goes. It is a really odd issue that I finally had time to look at yesterday.

martian_monster

Nothing logged in the SW MPE but all my DCs lit up again and this looks like it is happening every 12 hours. It happens at 3AM but not as much. The odd thing about this is the account that failed the login is the MPE name - not a service account or anything like that. I checked and there is nothing scheduled on the MPE. More digging.

Seashore

Another thought ; a sam application running every 12h with no credentials?

martian_monster

I did find a bunch of old reports in Orion that were running with old domain credentials but the times that they were running were a bit off. I disabled all of them to see if that clears things up. I will hunt through SAM and see if something goofy is going on there.