A while ago, we installed Quest / Performance Analysis and left it dormant. The server has since being decomission. But, unfortunately a few client installs are still orphaned out there.
It seems that client caches old authentication (username \ password) data which at times raises their old head.
I suppose we could back track a bit. Really was not sure that the problem was Quest. But, a “good” search through Event Viewer \ Security Log revealed the “Process ID” of the Application that was causing the failed login…
Reason: Unknown user name or bad password
User Name: joe
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: LABCOMP1
Caller User Name: LABCOMP1$
Caller Domain: LAB
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 4008
Transited Services: –
Source Network Address: –
Source Port: –
Thank Goodness the process was still running; as we were able to use “Task Manager” to match Process ID 4008 to quest_sc_mw.exe
And so, I started searching for a way to uninstall Quest or the very least disable it.
So looked through at the “Start up” folder and the “Services” Applet, but no luck.
Lauched SysInternals “Autoruns” and ordered by ImagePath. Viola found it…\
Once found, still do not know how to un-install it as it is not showing up “Add\Remove” programs – Probably the install was done via deamon. Whatever the case, will change start-up mode form Automatic to Disabled using Services Applet.