none
failed login attempts

    Question

  • one of the service account password has been changed. 

    source server : server1
    service account: svcadmin 

    I am getting error on my remote server that server1 with account svcadmin is trying to access remote server(server2).
    I cannot see much in logs which application is trying to access remote server.
    experts guide me. is it possible to check from registries


    Sunday, January 15, 2017 10:40 AM

All replies

  • You can start by checking the running services and scheduled tasks and see if any one of them is using the said service account. For scheduled tasks, you will need to check the scheduled scripts codes and see if any one of them is using the service account credentials. If this does not help then you need to check on the running applications and their domain settings.

    This posting is provided AS IS with no warranties or guarantees , and confers no rights.

    Ahmed MALEK

    My Website Link

    My Linkedin Profile

    My MVP Profile

    Sunday, January 15, 2017 11:42 PM
  • Hi

     You can check with "ms network monitor" or "wireshark" which app try to connect this server.

    Microsoft Network Monitor ; https://www.microsoft.com/en-us/download/details.aspx?id=4865

    Wireshark ; https://www.wireshark.org/download.html


    This posting is provided AS IS with no warranties or guarantees,and confers no rights. Best regards Burak Uğur

    Monday, January 16, 2017 7:18 AM
  • Hi,

    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, January 23, 2017 10:59 AM
    Moderator