Failed login attempts by Administrator in Events log

[mrjonboy]

I have just added my vcenter into our Active Directory so that users can log in with their Active Directory credetials rather than a local user and password on the vcenter server.

All seems to work fine but when looking in the events log I am getting many failed login attempts for user Administrator. See below :-

error 11/09/2009 09:48:00 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:54 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:49 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:49 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:43 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:38 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:32 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:26 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:20 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:18 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:15 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:09 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:47:04 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:58 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:53 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:48 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:47 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:42 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:46:36 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:54:31 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

error 11/09/2009 09:54:27 Failed login attempt for CITYOFBRISTOL\Administrator@127.0.0.1

We are using VI client 2.5

Any help would be most appreciated. I cannot find what or where the logins are coming from.

Thanks,

[bulletprooffool]

Check all the VMWare services on your host server - it is possible that one of them is trying to run as Admin, but has invalid ccredentials supplied.

[bulletprooffool]

It may not be VC though . .so check your other services too!

[mrjonboy]

All the Vmware services are running as local system account.

[Rajeev_S]

Hi,

what are the plugins you have installed? Is there any 3rd party plugins?

Hope this helps!

[mrjonboy]

Plugins installed are :-

SVMotion 1.0.0.0

VMware Update Manager Client 1.0.0.63972

VMware Converter Enterprise Client 4.0.1.62397

They are installed but not enabled on the server.

[Rajeev_S]

It might be enabled on someother console. Can you try to kill all the other VC console sessions under administration and monitor?

Hope this helps!

[mrjonboy]

Could the problem be an issue from changing the local administrator password.

I have also noticed the vpx.log has errors in it. e.g. Error 1326 see attachment.

Thanks,

Jon

[kamardash]

Hi,

I have exactly the same problem. Did you found solution ?

[nanev]

Hello mrjonboy,

Try to create new domain user. Assign to it administrator privilige at vCenter Server.

If you can logon with this account without errors, you must check what mode use vCenter (Workgroup or Domain).

I supose that your vCenter believe your administrator is different from expecting.

Write to me for the results.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

VSP4, VTSP4, VCP4

ITIL v.3 Foundation

[mrjonboy]

Hi,

Yes I did solve my problem. The problem was that I had changed the local Administrator Password.

I had a VDI Broker that had not had ther admin password changed so this was continually polling the VCenter server with the wrong credentials.

Once the credentials had been corrected I did not getting any errors on the events screen.

Thanks,

Jon

[kamardash]

In your case VDI Broker was a service ?

On the same computer or not ?

[mrjonboy]

In our case the VDI Broker was another server.

Jon

[dscheyen]

Exact same thing was happening to me. The issue was Vmware update manager running on one of my consoles. reinstalled it and tested fine.