I agree with wolram, it's probably the Active Directory connector, though you may have other tools (Cisco IDS or the like) that you setup with RADIUS or TACACS credentials linked to the domain. Ideally, the LEM would have a service account for domain queries.
You can get to the AD connector by going to Manage --> Appliance, clicking the gear to the left of the LEM and clicking "Connectors." Look for "Directory Service Query," stop and edit the tool to change credentials.