Why the built-in Admin user appears in the Enterprise Audit Log when the user hasn't logged in and performed any action (Spotfire Statistica)
Article ID: KB0138080
Updated On:
| Products | Versions |
|---|---|
| Spotfire Statistica | 14.x |
Description
The built-in Admin user can appear in the Audit Log multiple times when the Admin user has not logged in and performed an action. This is confusing as the built-in Admin user may not be logged in directly.
Environment
OS: Windows
Resolution
The built-in Admin user will appear when certain events occur.
Types of Entries
1. Expected with direct log in
When the Admin user logs in will it show two entries together, like below:
2. Expected with Task Sets
Task sets where the MASMonitorService is not using a Windows service account or the service account is not an Enterprise Memeber, there is no specific user id so the system uses Admin for the user that makes the entry for the MAS Alarm Report. So the user by default is the Admin account:
3. Expected with Failed User Logins
Admin will be listed as the user who added the information to the log for any failed login attempt. The reason is this is the system default. The Admin id for the person who creates an entry in the audit log:
Important Note:
- Even if the Admin user is disabled, the Admin is used to log failed login events. For more details about this account, see https://support.tibco.com/support-home/kbsearch/article?articleNumber=KB0138076 It is best practice to change the password to the built-in Admin account instead of to disable the account.
Issue/Introduction
This article discusses why the Admin user would appear in the Enterprise Audit Log when the user hasn't performed the action. This article also discusses why the Admin user may appear in the Audit Log.
Additional Information
Key information about the built-in Admin Enterprise account: https://support.tibco.com/support-home/kbsearch/article?articleNumber=KB0138076
MAS service account configuration: https://support.tibco.com/support-home/kbsearch/article?articleNumber=KB0070940
