NPM Attempting to access a local user account on windows servers and locking it every poll

Hi acurrent ,

Are the nodes (Windows servers) being polled by WMI or Agent?
Can you share which local account is being locked?

They are being polled by WMI.

Its the guest account on windows machines that is baked into the OS. Our organization disables it and sometimes renames it but that is the account being impacted.

This would be best handled by opening a support case.  I have a feeling something is configured to poll the guest account (or worse - use it for authentication) and it'll cause problems.

There's also (albeit a small chance) that someone is trying to log onto the Web Console of the platform with the local server guest's account (COMPUTERNAME\Guest) instead of the native platform's guest account (guest).

i have a support case open but not getting much traction so far.

There are no accounts using this for polling, i turned off app polling to confirm which modules it is that is doing this and it is npm. we have only domain service accounts, no local server accounts in use.

SolarWinds is trying to access this local server account on every poll within windows devices in our environment spanning multiple domains.

The account gets locked out every 30 min consistently on a singular device.

We have 2 SolarWinds instances in an active-active DR situation, so at any point a single windows server is being polled by 2 polling engines. If i unmanage the node in one environment, i can see within the security event log that the other instances polling engine starts getting logged as locking it out.

It is definitely a systematic attempt within npm polling that is trying to access this guest account. 

I even attempted deleting the guest account, you have to do it through cmd line as winodws does not allow you to delete the guest account by default. Even after deleting the account logs continue to be generated for the access attempts of the guest account. I'm guessing somewhere are residual objects of the account's existence. 

I do wonder if other people are seeing this.

 It is event id 470 within the windows security event log.

What platform version are you running?  I'm assuming you already uploaded diagnostics to the support portal?

i gave them the sanitized logs they requested but I'm in a secure env so can't give them diagnostics.

im on version 2023.4.2

Totally understand.  Our Public Sector THWACKsters have specific requirements.  Wish there was a way to check a box for diagnostics to "anonymize" the results.

Hopefully they give you some good information back.

Totally understand.  Our Public Sector THWACKsters have specific requirements.  Wish there was a way to check a box for diagnostics to "anonymize" the results.

Hopefully they give you some good information back.