topic Re: Software status polling and authentication in Server Management - Systems Insight Manager

Software status polling and authentication

Nancy Kafer — Mon, 24 Aug 2009 20:11:32 GMT

I am running HP SIM v05.03.01.00 on Windows 2003 server. We started getting the following events in the Security event log on my SIM server:

NOTE: is a domain user

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 08/24/2009
Time: 3:40:58 PM
User: NT AUTHORITY\SYSTEM
Computer:
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account:
Source Workstation:
Error Code: 0xC0000064

and

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 08/24/2009
Time: 3:40:58 PM
User: NT AUTHORITY\SYSTEM
Computer: INSIGHTMGMT
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I have tried figuring out where this is coming from and have found that I can make these events appear when I run the "Software status polling".

I have verified that my global credentials and system credentials are entered correctly. Any other time the SIM Mgmt User is used the domain version is used and there are no security events.

What is SIM trying to do that it would try to access the local SIM server using an account that is defined as a domain user?

Thanks.

Re: Software status polling and authentication

TechGuru — Thu, 27 Aug 2009 11:44:05 GMT

Check VCA's Configurations.

VCA will be configured with username & password to connect to VCRM.

you can reset details using "replicate Agent settings task".

Re: Software status polling and authentication

Nancy Kafer — Thu, 27 Aug 2009 18:03:12 GMT

I ended up completely rebuilding the server because there were other issues as well.

Once I got the server rebuilt I split out the monitoring between our Windows servers and our ESX servers since each system type as different credentials. I figured out that the "Daily System Identification" task was causing the issue. It was using the windows credentials for an ESX box and vice versa for the Windows VMs on my ESX box. Once I specified the system credentials for Sign-in, SNMP, and WBEM for each server and ran the task I stopped getting the errors.

Thanks for the help.