Scheduled Servcie locking account

We have an account used by a third party company to keep track of our server uptime (amoungst other things). So the software sends a pakcet of information to all of our servers every five minutes. If a response isn't recieved the software e-mails the guy onsite to let him know that there's been a problem.

The guy onsite gets the e-mail in the morning and logs onto the Server in question but never receives an error.

After some investigation it appears another piece of software is using that account and, i'm guessing, is using the wrong password so therefore locks the username out at 12:05 AM every morning. We have a half hour wait time on locked out users becoming automatically unlocked once again. So after half hour of negitive responses every 5 minutes the software gets that resopnse and continues as normal. Unfortunatly this is taking our UP time stat down and providing needless work for the guy onsite to deal with every morning.

Knowing all that we do on the matter now we need to locate what piece of software is scheduled to run at 12:05AM every night that uses the username.  I had hoped i could check the services accross the servers and find a service recorded as using that account but no such luck.

Does anyone know of a script or another piece of monitoring software we could use that records which software sends the login requests of a specified User account. If so it should only show two pieces of software and one of them is deliberate. knowing what the other software is will allow us to change its log in details to a new log in entirely leaving only the required uptime monitoring software using the Username and hopefully not locking it.

Any ideas would be greatly appreciated and if you need any more information then please let me know.

Thank you very mcuh in advance
Who is Participating?
Toni UranjekConsultant/TrainerCommented:

Check Event log for event with id 644. It should contain IP address of computer sending wrong credentials. Then download and install ALTools, from
This tools can help you find process that is sending wrong cresentials.


Leon TealePenetration TesterCommented:
is there nothing in control panel under 'scheduled tasks'?
Leon TealePenetration TesterCommented:
try this command in "cmd" to find any sccheduled tasks

at \\computername id
R1kxAuthor Commented:
Thank you veryu mcuh for your support with this is has led me to look in the right direction at least. The software you pointed me too was exceptionally usefull.

Thanks you very much
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.