I've recently set up my third APC unit for 3D printers along with interface cards for my two existing APCs in the server room. After getting everything up and running, I started getting alerts that say "Detected an unauthorized user attempting to access the SNMP interface from xxx.xxx.xxx.xxx." Interestingly, the two IP addresses trying to connect belong to HP laptops. I'm curious if HP Support Assistant could be the culprit behind this issue. I've found some old discussions suggesting this has been a problem for quite some time, yet it seems unresolved. I've removed most HP software from one laptop, keeping only sound and soft buttons, and I'm planning to monitor if the unauthorized access continues. It's hard to believe that this has persisted from 2017 to now without major complaints from the industry; my dissatisfaction with HP dates back to a past experience that made me stop purchasing their products. Still, I have these two older HP laptops that are decent for what I need. Has anyone else dealt with a similar situation?
3 Answers
For sure, those HP devices are likely scanning SNMP on their broadcast domain. It's a known issue, and many users have reported this behavior before. It's definitely worth checking into!
Yep, they definitely are the source of those access attempts. Uninstalling HP Support Assistant is usually the key to stopping those alerts. If you haven’t done that yet, I’d recommend giving it a go!
You might want to run ProcMon to track which process is sending those packets to your APC. That's often the best way to pinpoint the issue and confirm if it's coming from HP software.
Thanks for the tip! I’ll try that and see what I can find.