Skip to main content

How to handle persistent Prism Central admin lockouts caused by automated integrations (SIEM/Splunk)?

  • August 3, 2026
  • 1 reply
  • 11 views
Moaz Ahmed Abdelghany
Forum|alt.badge.img+1

Hi Everyone,

I wanted to share a real-world scenario I recently encountered regarding Prism Central account lockouts and see how the community handles similar setup challenges.

The Issue:

Our primary local administrator account on Prism Central kept getting locked out unexpectedly. After inspecting the logs, we traced the issue to an external automated log integration (like a SIEM/Splunk collector) executing API calls using stale credentials.

Even after disabling the integration at the source and resetting the admin password, the lockout behavior occasionally persisted due to cached sessions or residual background API requests.

How We Resolved It:

  1. Unlocked the user via CLI: Connected via SSH to Prism Central and ran:

    Bash
    ncli user unlock name=<Username>

  2. Created a Dedicated Admin Account: To isolate human administrative tasks from automated services, we provisioned a new, dedicated local admin account specifically for management.

  3. Isolated Integration Services: Assigned dedicated service accounts with least-privilege RBAC strictly for API and log collection.

Questions for the Community:

  • Have you faced similar issues where background API calls keep locking out primary admin accounts?

  • What are your best practices for managing API token lifecycles and service accounts in Nutanix environments?

Looking forward to hearing your insights and experiences!

Best regards,

Moaz Ahmed

    1 reply

    Allan Solomon Mejia
    Forum|alt.badge.img+1

    Great write-up, ​@Moaz Ahmed Abdelghany . I've seen similar issues in environments where SIEM platforms, monitoring tools, or automation scripts continue retrying authentication with outdated credentials after a password change.

    A few practices have consistently helped prevent recurring Prism Central admin lockouts:

    • Use dedicated service accounts for each integration (Splunk, monitoring, backup, automation, etc.) instead of the built-in admin account.
    • Treat the default admin account as a break-glass account and avoid using it for day-to-day integrations.
    • When a lockout occurs, review the authentication logs to identify the source IP generating the failed login attempts. This quickly identifies which system still has stale credentials.
    • If credentials are rotated, update every dependent integration at the same time to avoid repeated authentication failures.
    • Where possible, follow the principle of least privilege by assigning only the permissions required for the integration rather than full administrative access.

    One thing that's easy to overlook is that removing an integration doesn't always stop the failed logins immediately. Scheduled tasks, cached credentials, or another automation platform may still be attempting authentication. Tracking the source IP is often the fastest way to identify the culprit.

    Following these practices has helped keep Prism Central integrations both secure and operational in enterprise environments. Thanks for sharing the troubleshooting process. It will definitely help others facing the same issue.

    Terms & ConditionsAccessibility statement