We're having an issue that I'm trying to run to ground. We are a multiple location isolated network, where each site has its own SolarWinds 10.3.1 NPM installation (100 license. The primary site has a 250 license. All SolarWinds installs are using SQL Server 2005 Express. We are showing multiple ASPNET account failure audits on every domain controller in the network. All DCs are part of the same singular domain. The frequency of ASPNET failure audits can be as high as 10 per second on a given DC. Each site is using SolarWinds to monitor their local equipment, with the primary site monitoring all network connections and the file server located at each site. All monitoring is currently being done via SNMPv3.
Currently completed actions:
ASPNET local account password at primary site was changed awhile back due to a connection issue. Change was performed as part of troubleshooting.
ASPNET local account password at primary site was updated in the machine.config file in .net 4 config folder
ASPNET local account at primary site was removed from the machine.config file and reset back to autoConfig = "true"
ASPNET local account at primary site was disabled
We are currently monitoring it to see if disabling the account has an impact on the functioning of SolarWinds.
My question is, what is causing the ASPNET failure audits, and is the ASPNET local account even necessary?
My research on Thwack has shown there might be an issue using WMI to connect (which I disabled sure to the number of connections on each machine) and a possible cross-domain issue (all systems are part of the same domain, just with local replicated Domain Controllers for DNS).