Security Compliance
Frequent and repeated failed login attempts of Eminentware data grid service local login account in Patch Manager
You may see multiple logins at regular times for the ewdgssvc-##### account on Patch Manager Automation servers.
First published date
Last published date
Overview
Some environments may see repeated daily login attempts to other network resources from a Patch Manager Automation server from the local account being used for logon of the Emintentware Data Grid Service service.
These will appear as error 4625 and 4776 in the Windows Security Audit Event logs or similar event log readers (SEM, Splunk, etc).
Product section
Cause
When you see repeated failed login requests (at the same time each day, up to 80+ attempts) for the Eminentware data grid service local account (ewdgssvc-######) trying to connect to network computers (usually domain controllers), Patch Manager is trying to determine a computer's domain or workgroup name.
These will appear as error 4625 and 4776 in Windows Security Audit Event logs or similar event log readers (SEM, Splunk, etc).
It will call the GetComputerObjectName() Windows API with both the NameCanonical and NameFullyQualifiedDN values.
Resolution
This will not affect your network or environment, and is not considered a security risk.
The following Registry key might stop or minimize the login requests in some instances:
To disable login requests asking DC for Canonical Name, execute the following steps:
- Open the Registry editor (regedit)
- Go to 'HKEY_LOCAL_MACHINE\SOFTWARE\EminentWare\Common' path
- Add or modify a DWORD value called 'DisableGetComputerCanonicalName' and set the value to '1'