Excessive AD login attempts

Question

We have a UCS system configured for LDAP authentication against Active Directory. Everything is working as expected, but on the DCs we are seeing excessive failed login attempts originating from the fabric interconnect IPs against an invalid domain account. We are seeing anywhere from hundreds to thousands of attempts per day, so I don't believe these are due to invalid GUI login attempts or anything user driven. I've dug through the GUI but cannot find anything that would be using that account. The BindDN is set to use a different account created solely for this purpose. An example from the event log is posted below (192.168.32.12 is the primary FI). Any thoughts?
An account failed to log on.Subject:    Security ID:        SYSTEM    Account Name:        LP-DC02$    Account Domain:        CO    Logon ID:        0x3e7Logon Type:            3Account For Which Logon Failed:    Security ID:        NULL SID    Account Name:        Admin    Account Domain:        COFailure Information:    Failure Reason:        Unknown user name or bad password.    Status:            0xc000006d    Sub Status:        0xc000006aProcess Information:    Caller Process ID:    0x1dc    Caller Process Name:    C:\Windows\System32\lsass.exeNetwork Information:    Workstation Name:    LP-DC02    Source Network Address:    192.168.32.12    Source Port:        43342Detailed Authentication Information:    Logon Process:        Advapi      Authentication Package:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0    Transited Services:    -    Package Name (NTLM only):    -    Key Length:        0This event is generated when a logon request fails. It is generated on the computer where access was attempted.The  Subject fields indicate the account on the local system which requested  the logon. This is most commonly a service such as the Server service,  or a local process such as Winlogon.exe or Services.exe.The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

Answer 1

Hi Brad,
I checked my lab setup and do not see anything similar, can you let me know the UCSM version and i can check for that specific version.
Is there is any other AD intergation? back-up job? KVM access etc?
feel free to open a TAC case if you wish to and we should to able to look into the logs and figure out if there is a request going out from UCS for authentication of a specific account.
Thanks!
./Abhinav