I recently faced a challenging issue where a user account on Nutanix Prism Central was getting locked out every hour.
The Challenge:
Initially, the account was linked to Splunk integration. Even after we completely removed the integration with Splunk, the account lockout issue persisted, which indicated that the locking mechanism was still active somewhere in the environment.
The Troubleshooting Process:
Since removing the integration did not resolve the problem, it was clear that the issue wasn't just a simple misconfiguration of the old integration but rather a deep-seated credential issue tied to that specific account within the Prism Central environment.
The Solution:
To bypass the persistent lockout issue, I created a new dedicated Admin user account on Prism Central. By migrating the required administrative tasks to this new user, we successfully eliminated the recurring lockout, and the environment became stable again.
Troubleshooting Nutanix Prism Central admin account & Splunk Integration Issue
+1
+8That is why best practice is to ALWAYS you dedicated service accounts. So for splunk create an own account. for your backup and own account etc etc. The admin account is a breakglass account and that password should be kept in a safe and not being used. All administrators should have their own personal admin account.
+1That's absolutely correct. I was surprised that the customer was using the built-in Administrator account. That's why I followed up on the issue and advised them on the recommended account management best practices, including using dedicated service accounts, keeping the Administrator account as a break-glass account, and assigning each administrator their own personal admin account.
Nice troubleshooting. Creating a new dedicated admin account is a practical workaround, but I'd also recommend investigating what continued authenticating with the old credentials after the Splunk integration was removed. In many cases, scheduled searches, saved credentials, external automation, API clients, password vaults, or other monitoring tools may still be attempting to log in and causing repeated lockouts.
Using dedicated service accounts for integrations is definitely the right practice, while reserving the built-in admin account as a break-glass account. This also simplifies auditing and credential rotation. If an integration is retired, it's worth verifying that all stored credentials, tokens, and scheduled jobs have been removed to prevent lingering authentication attempts.
+1T
hanks Allan,I have already reviewed all of this and created a dedicated service account for everything to prevent any conflicts or collisions, ensuring the issue is fully resolved and the environment is now completely stable.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.