failed login attempt for <domainname>\Administrator@127.0.0.1 event

[RAINBOW007]

Hello Friends,

I'm getting the above event every second in my vcenter server version 2.5 U6. i don't know what this means. Can someone help me please. i need to fix this before monday.

failed login attempt for <domainname>\Administrator@127.0.0.1 event

I also get: "the server could not interpret the client's request", when i click on resources in VI client connected to vcenter server.

thanks

red

[Troy_Clavell]

did you check the account in quesion in AD?  Sounds like someone may have changed the password.  Do you have any 3rd party products (backup or reporting) solutions accessing vCenter?

[RAINBOW007]

Hi,

thanks for the reply. that account is a an administrator account and we have recently changed the password.where do we need to check? on vcenter itself? or somehwre else? sorry.I don't think anything else installed on vcenter.

thanks

red

[Troy_Clavell]

I would check vCenter since it's 127.0.0.1.  Maybe VMware Update Manager?  Do you have any services using that account on your vCenter Host OS?

[RAINBOW007]

Hi,

I got update manager installed on same vcenter update manager.

Q: Do you have any services using that account on your vCenter Host OS?

vcenter is on vmware HOST and it is a VM running windows 2003. All services are running under "local system" account. sorry i didn't get what you mean here. can please describe bit more....

I also get the error: when i try logging into vcenter using VI client. please find the error as attached

regards

red

[Troy_Clavell]

sounds like you also have a DNS issue going on.  Can you RDP to the Windows Host where vCenter is installed?

[RAINBOW007]

yes. i can RDP to the vcenter Server.

[alwaysnodowntim]

It sounds like there was a change with the Windows Administrator account password.  Additionally, you may have a scheduled task in windows and or vcenter that is configured to log in with the administrator account but it can't execute due to an invalid password for this account.  Check task scheduler in windows, and check your windows servers to see if you have a service that may have the administrator account configured to log in as well.  Make sure you have the correct Adminstrator password and when you see anything with domain\Administrator as the username, update it with the new password. Also, check your alarms and actions in vcenter.

[RAINBOW007]

thanks for your answer. i have uninstalled the vecenter and reinstalled it back. i have no scheduled tasks running under windows schedule task manager. i have nothing setup under vcenter either. I log into vcenter using <domainname>\administrator successfully. but i see this every second under events screen in vcenter.i can't get around this at all. please can someone help.