on both the SCSM management and datawarehouse, security event 4666 occurs roughly every hour

Question

on both the SCSM management and datawarehouse, security event 4666 occurs roughly every hour Roughly every hour, i get the following event of 4666. I refreshed the passwords on the AD and updated the runas accounts in SCSM. The passwords were not changed just reset to what they were since this is a service account only used by scsm. on the ms, the event will occur about 25 times and on the dw, it will occur once or twice. it course about 5 minutes different from each server. the ms will fire first then the dw. Any suggestions on what to look at? An application attempted an operation: Subject: Client Name: Username (not the real one) Client Domain: Domain (not the real one) Client Context ID: 16314645 Object: Object Name: IsUserAdministrator Scope Names: a2087bf2-3266-472f-8d24-f0a0284c5e8d Application Information: Application Name: Microsoft System Center Application Instance ID: 17883591 Access Request Information: Role: Role Groups: Group Operation Name: User_IsAdministrator__Check (142)