We have a UCS system configured for LDAP authentication against Active Directory. Everything is working as expected, but on the DCs we are seeing excessive failed login attempts originating from the fabric interconnect IPs against an invalid domain account. We are seeing anywhere from hundreds to thousands of attempts per day, so I don't believe these are due to invalid GUI login attempts or anything user driven. I've dug through the GUI but cannot find anything that would be using that account. The BindDN is set to use a different account created solely for this purpose. An example from the event log is posted below (192.168.32.12 is the primary FI). Any thoughts?
An account failed to log on.
Security ID: SYSTEM
Account Name: LP-DC02$
Account Domain: CO
Logon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Admin
Account Domain: CO
Failure Reason: Unknown user name or bad password.
Sub Status: 0xc000006a
Caller Process ID: 0x1dc
Caller Process Name: C:\Windows\System32\lsass.exe
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
Many users of technology in today's workforce are considered "remote workers". We have laptops, tablets, smartphones, etc. that allows us to stay connected if we choose ~96.259% of the time (personal "guestimate" percentage). When you get down to ...
Mega raid option does not appear when the server comes to the bios screen, I see the Megar aid PCI card when I look at the bios but I can not do in the configuration because all setting is disable. There are three from this server and they all have t...
•This field guide is meant to be used by customers for cleaning up an existing HyperFlex Edge deployment for the purposes of reinstalling.
•The procedures in this guide are DESTRUCTIVE. Make sure all VMs and data are backed up before proceedi...
i have installed two numbers of cisco VIC 1385 card on UCS C240M5 server but in CIMC VIC adapter section only one card is listed. i have installed the cards in slot number 4 & 5. in VIC adapter section only slot 5 is showing. In PCI adapter i could se...