Netikus Team,
A bit of history first. Prior to last week, I would consistently have about 30-40% of the devices I monitor giving me warnings because the agent had not been installed. This was because we have been rolling out a lot of stuff, and had been manually installing the agents before shipping out. As deadlines approached, this got tossed out the window, and we decided to remotely install the agents at a later date. Consequently leaving me with a high number of warnings, but I knew they were pinging, and that was sufficient. I have never been able to successfully remotely install the agents in mass due to not having a global user. I discovered the computer name variable, and I was good to go installing the agents remotely. So yesterday I spent some time going through and updating and installing agents on all the necessary computers. This morning I discovered several of the computers are still giving me warnings. I re-confirmed today through the management console that the services are running (Check Agent Status).
When I push the agents via the management console, I am setting the authentication as COMPUTERNAME\username (where COMPUTERNAME is the variable %computername%, and username is a local user for the device). If I go back and "Check Agent Status" in the management console, I am able to verify that the service is running as they should, even on the ones listed in the web report as giving me an error.
All of these devices are configured the same, and were built using the same Windows image (for the most part, we are talking 800 devices here, so it's likely there are a few that have been changed slightly here). The local user that is being used for authentication is an administrator on the computer.
The EventSentry Service runs as Local System, and EventSentry Heartbeat Monitor runs as a global user which is in the Administrators group.
Any suggestions on how to trouble shoot this?
Hi John,
The 'authentication' credentials are stored in the HKCU section of the registry so SYSADMIN#1 cannot use the credentials of SYSADMIN#2.
This causes an issue sometimes for the Heartbeat service as it's usually running under a domain administrator's account (SYSADMIN#3 for instance).
To resolve this issue you would need to login to the system as the admin account that the 'EventSentry Heartbeat Monitor' is running under and set the authentication for those systems while using that user account.
It looks like you're new here. If you want to get involved, click one of these buttons!