Hello OscarTroncosod51999,

This error means the user account "a" has been locked out due to exceeding the maximum number of failed login attempts from IP 128.221.252.101. This is a security feature to prevent brute-force attacks. Now you can unlock the account, or modify the lock out setting if you feel the need to. Once of the first thing that I would do is to unlock the account if the account is needed to be used. You can unlock the account by using Navisphere cli and running the following commands:

1. Unlock the Account via Navisphere CLI (from a different workstation)

```bash

# Check the current security settings

/opt/Navisphere/bin/naviseccli -h <SP_IP> -user sysadmin -password <password> security -failedlogin -list

# Clear the failed login attempts for the user

/opt/Navisphere/bin/naviseccli -h <SP_IP> -user sysadmin -password <password> security -failedlogin -reset -user a

2. Check Lockout Policy

```bash

# View the lockout policy settings

/opt/Navisphere/bin/naviseccli -h <SP_IP> security -failedlogin -list

```

This shows:

- Maximum failed attempts allowed

- Lockout duration

- Current failed attempt count

3. Modify Lockout Policy (if needed)

```bash

naviseccli -h <SP_IP> security -failedlogin -modify -maxAttempts <number> -lockoutDuration <minutes>

```

If **all** admin accounts are locked, you may need to:

- Wait for the lockout timer to expire

- Access the **Service Port** (SPA/SPB) directly

- Contact **Dell EMC Support** for assistance with a service-level reset

@DELL-Sam L​ Thank you for your prompt response. I am very grateful for your help. I have already run the tests you sent me. What I would like to know is which service uses the username 'a' so I can fix where it is configured, ensuring it stops trying to connect with a user that does not exist anywhere. How could I trace which services are checking the status of the SPs

Hello OscarTroncosod51999,

What is the current OE the is running on your VNX 5200?

@DELL-Sam L​ Hi thanks for you response, my current OE is 05.33.009.5.184 and File Software version is 8.1.9-184

Hello OscarTroncosod51999,

Thanks for the information. Let me look into this to see what I can find out.

@DELL-Sam L​ Hi could you found some? thanks.

Hello OscarTroncosod51999,

What is needed is to Identify the source IP 128.221.252.101 due to the systems repeatedly attempting authentication. Need to determine what host owns that IP: nslookup 128.221.252.101 or check your DNS/IPAM records. Also need to verify the username reported is a.

Check whether:

A monitoring tool is using an incorrect credential.

An application or script is attempting to log in with stale credentials.

An administrator accidentally configured a saved account.

You can review Unisphere/VNX logs, look for authentication failures around the same timestamp.

You can check: Unisphere security logs, Control Station logs (if applicable), LDAP/AD authentication logs , if external authentication is configured.

If using VNX M&R (Monitoring & Reporting), dell documents this error when one or more VNX systems are no longer being discovered successfully due to authentication failures. Testing and re-establishing the connection from the VNX M&R configuration page can clear the condition.

You may also want to check external authentication. If VNX is integrated with: Active Directory, LDAP, RSA Authentication Manager. Verify the account is not locked and credentials are correct.

You will need to check to ensure that host 128.221.252.101, and stop the failed login attempts.

Once that is done then you will want to unlock/reset the affected account if locked.

Update any stored credentials on monitoring servers, scripts, or management tools.

Confirm successful login afterward.