Scheduled Servcie locking account

Posted on 2008-11-04
Last Modified: 2013-12-04
We have an account used by a third party company to keep track of our server uptime (amoungst other things). So the software sends a pakcet of information to all of our servers every five minutes. If a response isn't recieved the software e-mails the guy onsite to let him know that there's been a problem.

The guy onsite gets the e-mail in the morning and logs onto the Server in question but never receives an error.

After some investigation it appears another piece of software is using that account and, i'm guessing, is using the wrong password so therefore locks the username out at 12:05 AM every morning. We have a half hour wait time on locked out users becoming automatically unlocked once again. So after half hour of negitive responses every 5 minutes the software gets that resopnse and continues as normal. Unfortunatly this is taking our UP time stat down and providing needless work for the guy onsite to deal with every morning.

Knowing all that we do on the matter now we need to locate what piece of software is scheduled to run at 12:05AM every night that uses the username.  I had hoped i could check the services accross the servers and find a service recorded as using that account but no such luck.

Does anyone know of a script or another piece of monitoring software we could use that records which software sends the login requests of a specified User account. If so it should only show two pieces of software and one of them is deliberate. knowing what the other software is will allow us to change its log in details to a new log in entirely leaving only the required uptime monitoring software using the Username and hopefully not locking it.

Any ideas would be greatly appreciated and if you need any more information then please let me know.

Thank you very mcuh in advance
Question by:R1kx
    LVL 6

    Expert Comment

    by:Leon Teale
    is there nothing in control panel under 'scheduled tasks'?
    LVL 6

    Expert Comment

    by:Leon Teale
    try this command in "cmd" to find any sccheduled tasks

    at \\computername id
    LVL 31

    Accepted Solution


    Check Event log for event with id 644. It should contain IP address of computer sending wrong credentials. Then download and install ALTools, from
    This tools can help you find process that is sending wrong cresentials.



    Author Closing Comment

    Thank you veryu mcuh for your support with this is has led me to look in the right direction at least. The software you pointed me too was exceptionally usefull.

    Thanks you very much

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    No security measures warrant 100% as a "silver bullet". The truth is we also cannot assume anything but a defensive and vigilance posture. Adopt no trust by default and reveal in assumption. Only assume anonymity or invisibility in the reverse. Safe…
    Article by: btan
    The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now