Applications Systems

Windows AD Domain Security Logs Show Machine Logon Attempts from the Orion Server

If an Orion polling engine server has a SAM component monitor for services or counters using the WMI fetching method that's assigned to a Windows domain controller server that is in a different and untrusted Windows domain than the Orion server failed machine account logon attempts may be seen in the domain security logs.

First published date

11/14/2018 8:02 PM

Last published date

11/14/2018 8:02 PM

Overview

If an Orion polling engine server has a SAM component monitor for services or counters using the WMI fetching method that is assigned to a Windows domain controller server that is in a different and untrusted Windows domain than the Orion server, you might see failed machine account logon attempts in the domain security logs.

Product section

Server Application Monitor

Cause

This appears to be a Microsoft defect related to the Microsoft link below:
https://social.msdn.microsoft.com/Forums/en-US/b3e546f3-1d7c-4520-92d8-23403b65c0cd/systemmanagement-causes-an-unexpected-failure-audit-events?forum=netfxbcl

(© 2017 Microsoft, available at https://social.msdn.microsoft.com, obtained on December 18, 2017)

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

Resolution

There is no known resolution at this time. The domain security log entries can be disregarded.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.