Deep Dive troubleshooting question
I'm having difficulties tracking down the source of a Service Account Lockout occuring in a fairly complex domain structure.
I've found it necessary to set WMI creds at the top of the heirarchy, with sub-groups having different WMI creds, as well as individual devices with their own.
On the domain controller that would be targeted with a sub-group WMI cred set, I see most 'Sources collecting correctly, but a few times a day, the SA is locking out. I find the 4740 on the DC, but can't quite track down the specific event (should be a 4625) causing the lockout. The only 4625 I'm finding show the Main group WMI creds... which are in a different domain.
Seems as though some 'Sources are using the wrong WMI creds (or defaults based on the Collector's SA).
The question: Is there a way to get a !TLIST showing the WMI.USER being leveraged in the debug console for each job?
Mike Moniz
·9 months agoI'm not sure about !TLIST and such, but I believe most, if not all, WMI requests are actually run from PowerShell (or atleast it use to) by the Collector. Perhaps it's worth enabling scriptblock logging in PowerShell on the Collector(s) so you can audit the commands that PS are running. Then check if you can see the WMI requests commands themselves from there.