AD authentication failures

cshirkoff

We changed password on the AD account used by NPM, NCM and SAM and seeing authentication failures when our Orion servers are reaching out to nodes/servers. We updated password in SAM credential library and ditto for NCM but are still seeing failures. We suspect someone hard-coded the username/password and didn't use the global entry, but do not know which nodes are causing the problem.

Anyone know where I can look in Orion logs for the node authentication failures?

Thanks

LeBeauUK

Hey, there is a really useful modern dashboard in the Content Exchange which was created by @jm_sysadmin and @KMSigma.SWI (Thank you) which shows you the status of your Solarwinds Server

https://thwack.solarwinds.com/content-exchange/the-orion-platform/m/modern-dashboards/2863

Anyway, right at the botton of the dashboard there is a section that shows you what a node is using for authentication, here is the SWQL from that part of the dashboard:

SELECT n.Caption AS [Node Name]
, n.detailsurl AS [_linkfor_Node Name]
, n.ip_address AS [IP Address]
, c.Name AS [WMI/SNMPv3 Credential Name]
, n.Community AS [SNMPv2 Community]
, 'Edit' AS [Edit]
, '/Orion/Nodes/NodeProperties.aspx?Nodes=' + ToString(n.NodeID) AS [_LinkFor_Edit]
, '/Orion/images/nodemgmt_art/icons/icon_edit.gif' as [_IconFor_Edit] 

FROM Orion.Nodes n
LEFT JOIN Orion.NodeSettings ns ON n.NodeID = ns.NodeID and ns.SettingName like '%Credential%' 
LEFT JOIN Orion.Credential c ON ns.SettingValue = c.ID 

WHERE n.objectsubtype IN ('WMI', 'SNMP')

Anyway, you can either import this SWQL in to a report and export it to a spread sheet, import the dashboard that is linked above or create your own dashboard and put the SWQL on to there (Both of the last ones you can make the widget searchable and then search for the device name).