Administrator left, now getting windows event security errors

[john oliver_6]

I am running HP System Insight Manager 6.0 on a Windows 2008 data center os. We recently had an administrator leave the company and now I am getting windows event logs secrutiy errors on our Domain Controller when some HP SIM schedule tasks runs. I've deleted his account within HP SIM, local administrator, and in AD but I am still getting the security failed logon errors. How can I repair this? Thank you in advance.

[BPE]

I guess that you administrator implemented a event automation inside SIM or a scheduled task inside SIM or he used his credential for the SIM access to managed system.

Login to SIM and verify the three places.
options->events->automatic event handling-> manage task

task->all scheduled tasks

options->security->Global Credentials

Options->security->users and Groups
try to remove his account but be sure that you still have somebody with admin rights inside SIM before you try it.

If you are not very familiar with SIM you should ask a HP SIM Consultant. It will be not easy to recover if you fail during the operations.

[john oliver_6]

No sir.. no luck. I have already removed the administrator from HPSIM. I do believe it is related to a schedule task inside SIM. Any thoughts?
Thank you

[David Claypool]

What's the frequency of the error? What error is it exactly? Is there a corresponding error in the Windows event log on the CMS? (Possibly 10009)

[johnjoliver]

The error is the Windows security event ID 680 found on one of our domain controller coming from the HPSIM server.  I have isolated the error to the HPSIM "Software version status polling" task that runs every two weeks.  But only the servers that the administrator had managed.  Thank you.

[Ralph Frampton]

I only monitor member servers that we are responsible for & not DC's in our company (different team) but it sounds like you have an issue with HP SIM accessing the DC's with an account that is no longer trusted there (eg. the accounts that you deleted).

If you wish to continue monitoring the DC's with that HPSIM CMS, then ensure you have implemented another AD account with appropriate rights/configuration on the CMS:

- check your Global Protocol settings & change if required to this new AD account/password

- check  your AD DC's system properties in case they aren't using global settings (these may have been configured with individual system properties that are over-riding the global ones)

- check all scheduled tasks (particularly the Software Status Polling ones), edit them & change ownership to new replacement AD account

Have you checked the CMS configuration, particularly that the defined WindowsAdminUserName in globalsettings.props matches a valid account (ie. a remaining account that you didn't delete)?