nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Failed windows logins from ./administrator and ./Administrator

noyesa

On all Windows nodes managed by my solarwinds server, i am seeing failed security events for logons from ./administrator and ./Administrator. I am trying to find what the cause of this is

event3.PNG

event2.PNG

event1.PNG

Find more posts tagged with

Accepted answers

noyesa

Found it! NTM had some scans configured on the solarwinds server. Was not showing up in the solarwinds UI. Had to launch the NTM tool on the server and delete all scans.

All comments

cnorborg

When you say "Managed by" what do you mean? ie: What modules are you using? How are they being monitored/managed, via an agent, or via something like WMI? Are they all using the same credentials? Do the credentials have administrator or Administrator in them? Are you doing any API polling of the server or the application on it? Do you know for sure that the login's are coming from the Solarwinds server?

So many questions, so few details…

noyesa

What modules are you using?

Not sure what this question is asking, can you clarify/reword?

How are they being monitored/managed, via an agent, or via something like WMI?

Are they all using the same credentials?

Do the credentials have administrator or Administrator in them?

Are you doing any API polling of the server or the application on it?

not sure where to check this, can you provide more info?

Do you know for sure that the login's are coming from the Solarwinds server?

yes, I can see in event viewer on Solarwinds server Security Event 4648 slightly before the event is generated on the other servers. It is using the same Administrator login.

So many questions, so few details…

sorry! I am pretty new to Solarwinds and chasing down Windows events so thanks for helping!

MMinion24

I'd be checking the source IP in the 4625 events first. If the failed logons are coming from the SolarWinds server itself and occur on a regular polling schedule, it's likely a stale or incorrect credential configured in Orion (WMI, WinRM, Discovery, or the Credential Library).

noyesa

It is coming from the SolarWinds server, and the weird part is it's not regular. It will sometimes happen multiple times a day, and sometimes have days in between events. I checked all my credentials in WMI and Credential Library. I don't have WinRM or Discovery configured at all. Is there a place I can check in the SQL Database on the SolarWinds server?

Thanks for your help!

bryan.gabay

Not sure if you've already checked this, but if you have the NCM module it could be an NCM Script or Job running on a schedule (could be made by you or Solarwinds built-in). Multiple scripts running on different schedules could be a reason for the irregularity. Also, Administrator is a standard Windows account, so it could be a pre-built thing doing it. I know that's a lot of "could possibly be". Best of luck!

noyesa

I have NCM, but I don't have any NCM Scripts defined.

For Jobs, I only have tasks running on my switches.

I couldn't find where to check for NCM Scripts running like the Job List shows. Can you tell me where to check?

Thanks for the help!

noyesa

Found it! NTM had some scans configured on the solarwinds server. Was not showing up in the solarwinds UI. Had to launch the NTM tool on the server and delete all scans.