Administrator left, now getting windows event security errors
I am running HP System Insight Manager 6.0 on a Windows 2008 data center os. We recently had an administrator leave the company and now I am getting windows event logs secrutiy errors on our Domain Controller when some HP SIM schedule tasks runs. I've deleted his account within HP SIM, local administrator, and in AD but I am still getting the security failed logon errors. How can I repair this? Thank you in advance.
Re: Administrator left, now getting windows event security errors
I guess that you administrator implemented a event automation inside SIM or a scheduled task inside SIM or he used his credential for the SIM access to managed system.
Login to SIM and verify the three places. options->events->automatic event handling-> manage task
task->all scheduled tasks
options->security->Global Credentials
Options->security->users and Groups try to remove his account but be sure that you still have somebody with admin rights inside SIM before you try it.
If you are not very familiar with SIM you should ask a HP SIM Consultant. It will be not easy to recover if you fail during the operations.
Re: Administrator left, now getting windows event security errors
No sir.. no luck. I have already removed the administrator from HPSIM. I do believe it is related to a schedule task inside SIM. Any thoughts? Thank you
Re: Administrator left, now getting windows event security errors
The error is the Windows security event ID 680 found on one of our domain controller coming from the HPSIM server. I have isolated the error to the HPSIM "Software version status polling" task that runs every two weeks. But only the servers that the administrator had managed. Thank you.
Re: Administrator left, now getting windows event security errors
I only monitor member servers that we are responsible for & not DC's in our company (different team) but it sounds like you have an issue with HP SIM accessing the DC's with an account that is no longer trusted there (eg. the accounts that you deleted).
If you wish to continue monitoring the DC's with that HPSIM CMS, then ensure you have implemented another AD account with appropriate rights/configuration on the CMS:
- check your Global Protocol settings & change if required to this new AD account/password
- check your AD DC's system properties in case they aren't using global settings (these may have been configured with individual system properties that are over-riding the global ones)
- check all scheduled tasks (particularly the Software Status Polling ones), edit them & change ownership to new replacement AD account
Have you checked the CMS configuration, particularly that the defined WindowsAdminUserName in globalsettings.props matches a valid account (ie. a remaining account that you didn't delete)?
