topic Administrator left, now getting windows event security errors in Server Management - Systems Insight Manager

Administrator left, now getting windows event security errors

john oliver_6 — Wed, 08 Jun 2011 19:03:37 GMT

I am running HP System Insight Manager 6.0 on a Windows 2008 data center os. We recently had an administrator leave the company and now I am getting windows event logs secrutiy errors on our Domain Controller when some HP SIM schedule tasks runs. I've deleted his account within HP SIM, local administrator, and in AD but I am still getting the security failed logon errors. How can I repair this? Thank you in advance.

Re: Administrator left, now getting windows event security errors

BPE — Thu, 09 Jun 2011 20:58:46 GMT

I guess that you administrator implemented a event automation inside SIM or a scheduled task inside SIM or he used his credential for the SIM access to managed system.

Login to SIM and verify the three places.
options->events->automatic event handling-> manage task

task->all scheduled tasks

options->security->Global Credentials

Options->security->users and Groups
try to remove his account but be sure that you still have somebody with admin rights inside SIM before you try it.

If you are not very familiar with SIM you should ask a HP SIM Consultant. It will be not easy to recover if you fail during the operations.

Re: Administrator left, now getting windows event security errors

john oliver_6 — Tue, 14 Jun 2011 12:21:12 GMT

No sir.. no luck. I have already removed the administrator from HPSIM. I do believe it is related to a schedule task inside SIM. Any thoughts?
Thank you

Re: Administrator left, now getting windows event security errors

David Claypool — Tue, 14 Jun 2011 14:21:23 GMT

What's the frequency of the error? What error is it exactly? Is there a corresponding error in the Windows event log on the CMS? (Possibly 10009)

Re: Administrator left, now getting windows event security errors

johnjoliver — Tue, 05 Jul 2011 14:19:22 GMT

The error is the Windows security event ID 680 found on one of our domain controller coming from the HPSIM server. I have isolated the error to the HPSIM "Software version status polling" task that runs every two weeks. But only the servers that the administrator had managed. Thank you.

Re: Administrator left, now getting windows event security errors

Ralph Frampton — Mon, 25 Jul 2011 22:32:28 GMT

I only monitor member servers that we are responsible for & not DC's in our company (different team) but it sounds like you have an issue with HP SIM accessing the DC's with an account that is no longer trusted there (eg. the accounts that you deleted).

If you wish to continue monitoring the DC's with that HPSIM CMS, then ensure you have implemented another AD account with appropriate rights/configuration on the CMS:

- check your Global Protocol settings & change if required to this new AD account/password

- check your AD DC's system properties in case they aren't using global settings (these may have been configured with individual system properties that are over-riding the global ones)

- check all scheduled tasks (particularly the Software Status Polling ones), edit them & change ownership to new replacement AD account

Have you checked the CMS configuration, particularly that the defined WindowsAdminUserName in globalsettings.props matches a valid account (ie. a remaining account that you didn't delete)?