Credential User belonged to a user who left the company some yeras ago

Question

Hello everyone,

the customer has reported a problem referred to a user account that belonged to an  employee wholeft the company some years ago.

While reviewing the Windows Server 2022 event logs, we noticed that this account is still associated with a SolarWinds process.

Specifically, the process involved is SolarWinds.BusinessLayerHost.exe.

I have already removed the user account from SolarWinds; however, the account still appears in the Windows event logs.

Could anyone please help me identify where this account is still configured so that it can be removed permanently?

Many thanks in advanced for your support.

Awaiting your news.

Rgds,

Paolo

Lofstrand · Answer

You can try running below SQL query against your database. Will check if where a username is used. Can be more places as @cnorborg says. Another place can be vmware/hyperv monitoring.

SELECT

    c.ID                AS CredentialID,

    c.Name              AS CredentialName,

    c.CredentialOwner,

    c.CredentialType,

    cp.Value            AS Username,

-- Node usage

    n.NodeID,

    n.Caption           AS NodeName,

    n.IP_Address        AS NodeIP,

    ns.SettingName      AS NodeSettingName,

-- SAM application-level usage

    aa.ID               AS SamApplicationID,

    aa.Name             AS SamApplicationName,

    aas.[Key]           AS SamApplicationSettingKey,

    aas.Value           AS SamApplicationSettingValue,

-- SAM component-level usage

    ac.ID               AS SamComponentID,

    ac.Name             AS SamComponentName,

    acs.[Key]           AS SamComponentSettingKey,

    acs.Value           AS SamComponentSettingValue

FROM dbo.Credential c

JOIN dbo.CredentialProperty cp

    ON cp.CredentialID = c.ID

LEFT JOIN dbo.NodeSettings ns

    ON ns.SettingValue = CAST(c.ID AS varchar(20))

LEFT JOIN dbo.NodesData n

    ON n.NodeID = ns.NodeID

LEFT JOIN dbo.APM_ApplicationSetting aas

    ON aas.Value = CAST(c.ID AS varchar(20))

   AND aas.[Key] IN ('CredentialSetId', 'SqlCredentialSetId')

LEFT JOIN dbo.APM_Application aa

    ON aa.ID = aas.ApplicationID

LEFT JOIN dbo.APM_ComponentSetting acs

    ON acs.Value = CAST(c.ID AS varchar(20))

   AND acs.[Key] = '__CredentialSetId'

LEFT JOIN dbo.APM_Component ac

    ON ac.ID = acs.ComponentID

WHERE cp.Name = 'Username'

  AND cp.Value LIKE 'localhost\administrator'

ORDER BY

    c.ID,

    n.Caption,

    aa.Name,

    ac.Name;

cnorborg · Answer

Check your scheduled reports maybe?