Scheduled Servcie locking account

Posted on 2008-11-04
Medium Priority
Last Modified: 2013-12-04
We have an account used by a third party company to keep track of our server uptime (amoungst other things). So the software sends a pakcet of information to all of our servers every five minutes. If a response isn't recieved the software e-mails the guy onsite to let him know that there's been a problem.

The guy onsite gets the e-mail in the morning and logs onto the Server in question but never receives an error.

After some investigation it appears another piece of software is using that account and, i'm guessing, is using the wrong password so therefore locks the username out at 12:05 AM every morning. We have a half hour wait time on locked out users becoming automatically unlocked once again. So after half hour of negitive responses every 5 minutes the software gets that resopnse and continues as normal. Unfortunatly this is taking our UP time stat down and providing needless work for the guy onsite to deal with every morning.

Knowing all that we do on the matter now we need to locate what piece of software is scheduled to run at 12:05AM every night that uses the username.  I had hoped i could check the services accross the servers and find a service recorded as using that account but no such luck.

Does anyone know of a script or another piece of monitoring software we could use that records which software sends the login requests of a specified User account. If so it should only show two pieces of software and one of them is deliberate. knowing what the other software is will allow us to change its log in details to a new log in entirely leaving only the required uptime monitoring software using the Username and hopefully not locking it.

Any ideas would be greatly appreciated and if you need any more information then please let me know.

Thank you very mcuh in advance
Question by:R1kx
  • 2

Expert Comment

by:Leon Teale
ID: 22876865
is there nothing in control panel under 'scheduled tasks'?

Expert Comment

by:Leon Teale
ID: 22876908
try this command in "cmd" to find any sccheduled tasks

at \\computername id
LVL 31

Accepted Solution

Toni Uranjek earned 645 total points
ID: 22876979

Check Event log for event with id 644. It should contain IP address of computer sending wrong credentials. Then download and install ALTools, from http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
This tools can help you find process that is sending wrong cresentials.



Author Closing Comment

ID: 31513098
Thank you veryu mcuh for your support with this is has led me to look in the right direction at least. The software you pointed me too was exceptionally usefull.

Thanks you very much

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question