Return
-
Title
Failed logins for HerculesService showing in Windows Event Logs -
Description
When using the "Windows Server" or "Windows Desktop" platforms password checks of Windows managed asset are generating failed logins for the user "HerculesService" in local Windows Event logs. -
Cause
This authentication is down to the Microsoft COM (Component Object Model) garbage collection mechanism.
When a WMI client terminates abnormally, Microsoft implements an garbage collection mechanism in which the RPCSS process on the client machine (Safeguard) pings the target machine (the Asset).. This process uses the account that the RPCSS process is running under - on Safeguard this is HerculesService. As this account does not exist on the target machine, a failed login event will be logged.
This issue can be reproduced outside of One Identity Safeguard, using tools such as wbemtest. -
Resolution
WORKAROUND
To avoid seeing this security event, ensure that the service accounts setup on the Windows systems are configured correctly (correct username/password) on all managed Windows systems.
Alternatively, use the "Windows Desktop (SSH)" / "Windows Server (SSH)" or "Windows Desktop (WinRM)" / "Windows Server (WinRM)" platforms, these use different mechanism to check passwords.
STATUSMicrosoft has completed their investigation into this issue, and confirmed Windows is working as designed and this behaviour cannot be changed. -
Change Request
200485