Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows Server 2003, VMWare VirtualCenter 2.5.

Something is continuously trying to log on to VirtualCenter using a disabled domain account; the failed logon attempts are logged by VirtualCenter in its own logs and by Windows in the Security event log. This happens roughly every minute or two. The source of the logon attempts is 127.0.0.1, so it must be some process running on the server itself.

There are no services running as this user account and no scheduled jobs on the system. The task manager doesn't show any process running under this account, either.

The user account's name is nowhere to be found in the Registry.

But some process is trying to use it, and failing. It probably is not some critical process, as everything seems to be working fine, apart from those log entries; it could just be something that was installed long ago and forgotten there.

Whatever it is, it probably is running under another user account (possibly a system one), but is actively trying to log on to VC using those credentials, which are probably saved in some configuration file, since they're not stored in the Registry.

How can I track which process is trying (and failing) those logon attempts, either by auditing Windows or VirtualCenter?

share|improve this question
    
Are there any additional vCenter modules installed that might have user accounts associated with them but stored in a database? Any third party stuff in particular? –  Helvick May 7 '10 at 18:59
    
Yes, there are: Update Manager, Converter, Backup, License Managere... there's a full-blown VirtualCenter configuration on that server. But everything is working fine, and it wouldn't if it couldn't login... –  Massimo May 8 '10 at 15:56

2 Answers 2

I would try using procmon and filtering on the userid. That should turn up anything that is sporadically running as that user.

share|improve this answer
    
The process will not run as that user, because the user account can't be used to log in at all (it has been deleted). Whatever it is that's doing this, is running as something else, but is trying to log in to Virtual Center using that user account. –  Massimo May 7 '10 at 18:55
1  
@Massimo: then my next step would probably be to use a utility like Astrogrep to see if I can find a configuration file with the username in it. astrogrep.sourceforge.net –  MattB May 7 '10 at 20:03
    
Ok, this looks nice... I'll give it a try :-) –  Massimo May 8 '10 at 15:54
    
It was really good. Didn't help because the login info were saved in a binary file, though. –  Massimo May 10 '10 at 10:03
up vote 1 down vote accepted

It was an old agent for a monitoring program (not used anymore).

How I found it:

  • Guessed it was opening connections to Virtual Center (TCP port 443), trying to authenticate, failing, closing connections.
  • Used NETSTAT to look for connections in closing state after the event log entry appeared.
  • Found process ID.
  • Found process.
  • Stopped service, events stopped.

The program's log confirmed it was always failing logons.

Uninstalled succesfully (it was not used anymore), problem solved :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.