Netwrix Auditor Data Collection Account: Failed Logons | Account Lockouts

Uncategorized
Data Collection Account
DCA
failed logons
lockout
https://kb.netwrix.com/3793
Copy Article URL Copied

Scenario

Logon Activity reports show that the Data Collection Account is producing failed logons and/or getting locked out.

Cause

One of the locations seen below has expired credentials.

Solution

Monitoring Plans

Credentials entered for a monitoring plan are found by navigated from the Netwrix Auditor Home Page > Monitoring Plans > Double-click a selected Monitoring Plan > Edit Settings (Top right).

Enter good and current credentials under the Data Collection Tab

Custom Data Collection Account

There may be times when a custom account is needed for the auditing of a specific data source. The input field for custom Data Collection Accounts is found by navigating from the Netwrix Auditor Home Page > Monitoring Plans > Double Click a selected Monitoring Plan > Double Click a selected Item.

Enter good and current credentials into the Custom Account fields. If you are using the Default Data Collection Account, leave the custom fields blank.

SQL & SSRS Settings

Found by navigating from the Netwrix Auditor Home Page > Settings > Audit Database Tab

Enter good and current credentials by clicking “Modify” for both SQL and SSRS settings.

Services

Some Netwrix Auditor services may be ran by the Netwrix Auditor Data Collection Account. Identify such services

Right-click the service and select “Properties”

Enter good and current credentials and click “OK”.

Password Expiration Notifier, Event Log Manager, and Inactive User Tracker

Netwrix Auditor comes installed with three additional programs that provide additional avenues of auditing. Navigating to the Data Collection Account credentials will be the same for all three. Find the programs via the Start Menu > Select a Monitoring Plan > Click “Edit”.

Note: If you do not have any monitoring plans for these programs, you may skip this step.

Enter good and current credentials for these collectors and click “Save”.

The issue has not been resolved…

If you are still receiving failed logons and/or lockouts for your Netwrix Auditor Data Collection Account, please consider the following:

  • Confirm that no other applications are using the same account as a service account (i.e. Back up software, Virus Scanners, etc.)
  • Stop Netwrix Services for a frame of time. Take note of the window of which the services are stopped. Once services are running again, allow some time for data to upload to SQL. After waiting, run a search like the one below:
  • If any failed logons and/or lockouts are reported for the Data Collection Account, Netwrix is certainly not the root cause.
  • Lastly, Technical Support is equipped to assist in cases where the proposed solutions above do not resolve the issue.
Go Up