Software status polling and authentication

[Nancy Kafer]

I am running HP SIM v05.03.01.00 on Windows 2003 server. We started getting the following events in the Security event log on my SIM server:

NOTE: is a domain user

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 08/24/2009
Time: 3:40:58 PM
User: NT AUTHORITY\SYSTEM
Computer:
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account:
Source Workstation:
Error Code: 0xC0000064

and

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 08/24/2009
Time: 3:40:58 PM
User: NT AUTHORITY\SYSTEM
Computer: INSIGHTMGMT
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain:
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name:
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I have tried figuring out where this is coming from and have found that I can make these events appear when I run the "Software status polling".

I have verified that my global credentials and system credentials are entered correctly. Any other time the SIM Mgmt User is used the domain version is used and there are no security events.

What is SIM trying to do that it would try to access the local SIM server using an account that is defined as a domain user?

Thanks.

[TechGuru]

Check VCA's Configurations.

VCA will be configured with username & password to connect to VCRM.

you can reset details using "replicate Agent settings task".

[Nancy Kafer]

I ended up completely rebuilding the server because there were other issues as well.

Once I got the server rebuilt I split out the monitoring between our Windows servers and our ESX servers since each system type as different credentials. I figured out that the "Daily System Identification" task was causing the issue. It was using the windows credentials for an ESX box and vice versa for the Windows VMs on my ESX box. Once I specified the system credentials for Sign-in, SNMP, and WBEM for each server and ran the task I stopped getting the errors.

Thanks for the help.