Network Management

Intermittent "Login failed for user 'DOMAIN\ServerName$'" errors on cross-domain Additional Polling Engines

Additional Polling Engines (APEs) in a different domain than the SolarWinds Platform database server intermittently fail with "Login failed for user 'DOMAIN\ServerName$'" when the SWNetPerfMon.DB file does not contain explicit database credentials. This affects all SolarWinds services on the poller — SWIS, Collector, APM Probes, and SCM — and can manifest as AppInsight for SQL data processing errors, blank dashboards, or Unknown/Down node statuses.

First published date

5/11/2026 6:38 PM

Last published date

5/11/2026 7:00 PM

Overview

Symptoms

"Data processing error: Login failed for user 'DOMAIN\ServerName$'" on AppInsight for SQL, AppInsight for IIS, or other application monitors.
SQL Server error logs on the SolarWinds Platform database server show repeated login failures for the polling engine machine accounts (identified by the $ suffix, e.g., DOMAIN\POLLERNAME$).
The issue is intermittent — monitoring works normally at times and fails at others.
Only polling engines in a different domain from the SolarWinds Platform database server are affected; polling engines in the same domain work normally.
Multiple SolarWinds services on the affected poller fail simultaneously — not just one application or monitor.

Collector.Service.log:

2026-01-01 12:00:00,000 [Plan xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx SolarWinds.Node.HardwareHealth.Snmp N:1234] ERROR SolarWinds.Collector.Node.HardwareHealth.HardwareHealthMonitoringJob - Unexpected error during polling for node 1234 plan xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at System.Data.SqlClient.SqlInternalConnectionTds..ctor(...)
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)
   at SolarWinds.Common.Data.DatabaseFunctions.InnerCreateConnection(String providerType, String connectionString)
Error Number:18456,State:1,Class:14

Windows Application Event Log:

Application: SolarWinds.InformationService.ServiceV3.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at SolarWinds.InformationService.Core2.Security.LimitationSnapshotDAL.ExecuteReader(...)
   at SolarWinds.InformationService.Core2.Security.LimitationSnapshotService.ReloadLimitationSnapshot(...)
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)

Orion.InformationService.log:

ERROR SolarWinds.InformationService.Core2.InformationService - InformationService.RunQuery encountered error
System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)
   at SolarWinds.Common.Data.DatabaseFunctions.InnerCreateConnection(String providerType, String connectionString)

SWNetPerfMon.DB (affected — missing credentials):

Provider=SQLOLEDB.1;Data Source=ORIONDBSERVER.domain.com;
Initial Catalog=SolarWinds_ORION;integrated security=SSPI

SWNetPerfMon.DB (working — credentials present):

Provider=SQLOLEDB.1;Data Source=ORIONDBSERVER.domain.com;
Initial Catalog=SolarWinds_ORION;user id=xxxxx;Encrypted.password=xxxxx

Product section

Network Performance Monitor

Cause

The SWNetPerfMon.DB file on the affected polling engine(s) uses integrated security=SSPI without explicit user id and Encrypted.password entries. This means the poller relies on cross-domain Windows impersonation (Kerberos delegation) to connect to the SolarWinds Platform database.

When cross-domain impersonation intermittently fails (due to Kerberos ticket expiration, domain trust issues, or network interruptions), the connection falls back to the polling engine's machine account (e.g., DOMAIN\POLLERNAME$). Since the machine account does not have a SQL login on the SolarWinds Platform database server in the other domain, all database connections from that poller fail.

This cascading failure affects every service on the poller because they all depend on the SolarWinds Platform database connection:

SWIS (InformationService) — cannot run queries, reload containers, or check user permissions
Collector Service — cannot execute polling plans
APM Probes — cannot retrieve application monitor configurations or write poll results
SCM Pollers — cannot execute Asset Inventory or configuration monitoring queries

Resolution

Step 1 — Verify SWNetPerfMon.DB

On the affected polling engine, open the following file in a text editor:

C:\Program Files (x86)\SolarWinds\Orion\SWNetPerfMon.DB

Affected (missing credentials):

Provider=SQLOLEDB.1;Data Source=ORIONDBSERVER.domain.com;
Initial Catalog=SolarWinds_ORION;integrated security=SSPI

If the file contains integrated security=SSPI but does not contain user id= and Encrypted.password= lines, this confirms the issue.

Compare with a working polling engine in the same domain as the SolarWinds Platform database — it should have both entries:

Working (credentials present):

Provider=SQLOLEDB.1;Data Source=ORIONDBSERVER.domain.com;
Initial Catalog=SolarWinds_ORION;user id=xxxxx;Encrypted.password=xxxxx

Step 2 — Confirm from logs

Collect diagnostics from the affected polling engine and search the following logs for Login failed. If all of these logs show the same machine account login failure, it confirms the issue is the poller-to-SolarWinds Platform-database connection (SWNetPerfMon.DB), not an individual application monitor credential.

Log File	Location	What to Look For
`Orion.InformationService.log`	`Logs\`	`Login failed for user 'DOMAIN\ServerName$'` in `ImpersonationContext.RunImpersonated` calls
`Collector.Service.log`	`Logs\`	Same error across multiple polling plans
`SolarWinds.APM.Probes*.log`	`Logs\APM\`	`Named Pipes Provider, error: 40` or `SqlException` errors
`SCM.Pollers.Jobs*.log`	`Logs\`	`Login failed` on Asset Inventory SWIS queries
Windows Application Event Log	`EventLogs\`	`SolarWinds.InformationService.ServiceV3.exe` crash events with `SqlException`

Sample — Collector.Service.log:

2026-01-01 12:00:00,000 [Plan xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx SolarWinds.Node.HardwareHealth.Snmp N:1234] ERROR SolarWinds.Collector.Node.HardwareHealth.HardwareHealthMonitoringJob - Unexpected error during polling for node 1234 plan xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at System.Data.SqlClient.SqlInternalConnectionTds..ctor(...)
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)
   at SolarWinds.Common.Data.DatabaseFunctions.InnerCreateConnection(String providerType, String connectionString)
Error Number:18456,State:1,Class:14

Sample — Windows Application Event Log:

Application: SolarWinds.InformationService.ServiceV3.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at SolarWinds.InformationService.Core2.Security.LimitationSnapshotDAL.ExecuteReader(...)
   at SolarWinds.InformationService.Core2.Security.LimitationSnapshotService.ReloadLimitationSnapshot(...)
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)

Sample — Orion.InformationService.log:

ERROR SolarWinds.InformationService.Core2.InformationService - InformationService.RunQuery encountered error
System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'DOMAIN\POLLERNAME$'.
   at SolarWinds.Common.Data.ImpersonationContext.RunImpersonated(Action action)
   at SolarWinds.Common.Data.DatabaseFunctions.InnerCreateConnection(String providerType, String connectionString)

Step 3 — Re-run Configuration Wizard

Re-run the Configuration Wizard on the affected polling engine(s) to regenerate the SWNetPerfMon.DB file with explicit database credentials.

Pre-requisites:

Identify the correct database credentials by checking the SWNetPerfMon.DB file on a working polling engine (one in the same domain as the SolarWinds Platform database where user id and Encrypted.password are present). Note the credentials — you will use the same ones when running the Configuration Wizard on the affected pollers.
Take a backup of the current SWNetPerfMon.DB file on the affected poller(s):
- Navigate to C:\Program Files (x86)\SolarWinds\Orion\.
- Right-click on SWNetPerfMon.DB and select Copy.
- Right-click in the same folder and select Paste to create a backup copy.
Schedule a maintenance window — the Configuration Wizard will restart SolarWinds services on the poller.

For standalone APEs (no HA):

On the affected APE, open the Configuration Wizard from the Windows Start Menu (SolarWinds Platform > Configuration Wizard).
Proceed through the wizard. On the Database step, enter the same database credentials noted from the working poller.
Complete the wizard and allow the services to restart.
Verify the SWNetPerfMon.DB file now contains explicit user id and Encrypted.password entries.

For APEs in HA pools:

When the affected polling engine is part of an HA pool, the HA pool must be disabled before running the Configuration Wizard to prevent unplanned failovers or HA state corruption. The Configuration Wizard must be run on both the active and standby members of the pool.

For each HA pool (one pool at a time):

In the SolarWinds web console, navigate to Settings > My Deployment > Pools.
Select the HA pool and toggle High Availability to Off to disable the pool.
Wait at least 5 minutes after disabling to allow all HA processes (including RabbitMQ cluster disconnect) to complete.
On the active poller, run the Configuration Wizard and enter the correct database credentials on the Database step.
Verify the SWNetPerfMon.DB file now contains explicit user id and Encrypted.password entries.
Repeat steps 4–5 on the standby poller.
Re-enable the HA pool from the web console (Settings > My Deployment > Pools > toggle High Availability to On).
Confirm the pool status shows Healthy and both members display the correct roles.
Proceed to the next HA pool.

Step 4 — Verify

After completing the steps on all affected pollers:

Monitor the AppInsight for SQL applications and other monitors on nodes polled by the affected engines — the "Login failed" errors should no longer appear.
Check the SQL Server error logs on the SolarWinds Platform database server — login failures for the machine accounts should stop.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.