Scheduled Servcie locking account

We have an account used by a third party company to keep track of our server uptime (amoungst other things). So the software sends a pakcet of information to all of our servers every five minutes. If a response isn't recieved the software e-mails the guy onsite to let him know that there's been a problem.

The guy onsite gets the e-mail in the morning and logs onto the Server in question but never receives an error.

After some investigation it appears another piece of software is using that account and, i'm guessing, is using the wrong password so therefore locks the username out at 12:05 AM every morning. We have a half hour wait time on locked out users becoming automatically unlocked once again. So after half hour of negitive responses every 5 minutes the software gets that resopnse and continues as normal. Unfortunatly this is taking our UP time stat down and providing needless work for the guy onsite to deal with every morning.

Knowing all that we do on the matter now we need to locate what piece of software is scheduled to run at 12:05AM every night that uses the username.  I had hoped i could check the services accross the servers and find a service recorded as using that account but no such luck.

Does anyone know of a script or another piece of monitoring software we could use that records which software sends the login requests of a specified User account. If so it should only show two pieces of software and one of them is deliberate. knowing what the other software is will allow us to change its log in details to a new log in entirely leaving only the required uptime monitoring software using the Username and hopefully not locking it.

Any ideas would be greatly appreciated and if you need any more information then please let me know.

Thank you very mcuh in advance
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Leon TealeSenior Penetration TesterCommented:
is there nothing in control panel under 'scheduled tasks'?
Leon TealeSenior Penetration TesterCommented:
try this command in "cmd" to find any sccheduled tasks

at \\computername id
Toni UranjekConsultant/TrainerCommented:

Check Event log for event with id 644. It should contain IP address of computer sending wrong credentials. Then download and install ALTools, from
This tools can help you find process that is sending wrong cresentials.



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
R1kxAuthor Commented:
Thank you veryu mcuh for your support with this is has led me to look in the right direction at least. The software you pointed me too was exceptionally usefull.

Thanks you very much
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.