How to track down which service fails to login on servers.

andy_roth

I changed the domain admin password. I am receiving SEM notices like this.

This user account: logon failure "inventory\administrator"

At: 2022-04-13 01:30:02.0

From: inventory

Source Machine: inventory

Destination Machine: inventory

Destination Account: administrator

Reason: unknown user name or bad password.

Extraneous Info:sourceport: -; call-processname: c:\windows\system32\svchost.exe;

I suspect svchost.exe is trying to call a service, task mapping, etc.. that needs the new admin password. This is happening on a few servers.

I did not understand why I was getting this err on our copier until someone came to me stating our faxes were not getting saved to a network drive. It needed the new admin PW.

How can I found out which is failing?

Thanks

Andy

npatterson

First, if would check if you have the proper logging enabled on the DC check the security logs cover both Success and Failures as this is not typical.

The best method I can do is follow the MS baseline setting for the version of windows as it gives the GPO settings for normal server and DC.  This way you sure you are logging incidents in windows correctly so SEM can pull the records.