SolarWinds attempts to log into a remote server as OrionHostName$

10/16/2018 8:23 PM

2/21/2025 11:19 PM

In the DC Security logs report, SolarWinds attempted to log in to a server as OrionHostName$.  The credentials do not provide any information.

The Event ID is 4625:
 

• Log Name:   Security
• Source:        Microsoft-Windows-Security-Auditing
• Date:            1/01/2016 12:00:00 AM
• Event ID:      4625
• Task Category: Logon
• Level:           Information
• Keywords:    Audit Failure
• User:            N/A
• Computer:     OrionServerName
• Description:   An account failed to log on.
• Subject          -
• Security ID:   NULL SID
• Account Name:     -
• Account Domain:   -
• Logon ID:     0x0
• Logon Type:  3

 

Orion Platform

The issue is caused by a known Microsoft bug.

Resolution 1:

• See the following Microsoft KB: System Management causes an unexpected Failure Audit events  
• A possible resolution is to run the Job Engine v2 from the SolarWinds side as a Local Admin instead of using a System account. If that doesn't resolve the issue, try monitoring the node via SNMP and use the RPC fetching method for application component monitors instead of WMI.
• Warning: This can be undone if you uninstalled/reinstalled the Job Engines or if you upgraded/ran the configuration wizard.

Resolution 2:
Scenario: You can't find the old service account mentioned on the event ID anywhere from the Orion. This account still being used somehow in Orion even it doesn't exist anymore.

Here's what to do where to locate this user:

• Gather diagnostics
• Use Agent Ransack , then search the full name of the account in "containing text":After starting the search, select any file on left pane and you will see the results on the right pane of the agent ransack window.
• From there, you will get the exact information or hint where the account being used in Orion.