3

I have a Windows 7 laptop (domain member), and when I connect a VPN to the office, within 5-10 minutes the main file server/domain controller reports a failed logon for the user account, then 3, then 5, then the user account locks.

It happens with no extra software running, so it's not an Outlook problem, for instance.

I have been through control panel and cleared out the Windows and .Net password cache. There are no mapped printers, there is a mapped drive but it appears to work, and there are no scheduled tasks I can find which run so often. I have reset the user's password and put the new one on the laptop.

I have also put Wireshark on the laptop, but all that can see is "encrypted traffic" going over the VPN.

A friend has said there are issues with Windows 7 and Windows 2003 Server, e.g. with the LM hash settings which needs a hotfix. He was quite vague and there's another user with Windows 7 for whom this doesn't happen.

My suspicion is that it's Windows doing this, not a third party installed program.... but how can I dig into this further and find what's causing it?

****Update: I have disconnected the mapped drive, and the problem still happened - 4 login failures within two minutes of connecting the VPN to the office.

Event logs on the server shows Source: Security, Category: Account Logon, ID 675, Pre-authentication failed. Username: (computer-name)$, Service Name: krbtgt/domain.fqdn.example.org, failure code: 0x19

Followed by Event Security / 680 / Account Logon, MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 / Error Code: 0xC000006A Account logoff / Unknown user name or bad password (both repeat 4 times)

Update

I think I have it - the VPN username is the same as the Windows account username, but the passwords are different (because the VPN connects to a firewall, not a Windows server), however when accessing network resources Windows seems to be trying the VPN credentials first - because the account name is the same, the password failures cause the Windows account to become locked.

I've changed it so the VPN uses a different username and in a few minutes of testing, that seems to workaround it at least.

Would be interested if anyone knows why the (Windows 7 PPTP) VPN might behave like this and if there's an official way to stop it.

4 Answers 4

2

I have seen this happen when someone has left himself or herself logged in to another system using the same AD account. We had a rough time here with one such example. We ended up looking in the security logs on the Domain Controllers to figure out where the user had left herself logged in. Once we found out where that was we logged the user out and everything went back to normal.

I have not heard of the Win 7 / Server 2003 issue. I regularly use a Win 7 machine to administer my 40+ Server 2003 and 2008 boxes. But that's not to say this isn't the cause.

Also, I've seen a couple times when a vpn connection is unstable, and a user has the credentials saved, it may attempt to authenticate each time that the connection is dropped. This could potentially result in such a situation.

Good luck :)

2
  • The VPN endpoint is a hardware firewall, it's not using the domain account. I don't understand why being logged on elsewhere would cause it, but I'm reasonably confident they are a small enough company - ~5 people - and this has been ongoing long enough - weeks - that we'd have spotted that, or had times that wasn't the case. Oct 14, 2010 at 18:21
  • sorry I am used to working in an environment where VPN authentication uses AD so I just assumed it was the same for you.
    – Dennis
    Oct 15, 2010 at 16:23
2

Dennis raises a good point. The other way I've seen this happen is that you have 3rd party applications or something (3rd party or not) installed as a service that has been given the credentials and is repeatedly using them to attempt to connect to something.

1
  • Thanks for the idea - I had looked through the service list and found nothing that I could see which would be set to do that. Oct 22, 2010 at 16:48
1

As my last update - I think I have it - the VPN username is the same as the Windows account username, but the passwords are different (because the VPN connects to a firewall, not a Windows server), however when accessing network resources Windows seems to be trying the VPN credentials first - because the account name is the same, the password failures cause the Windows account to become locked.

I've changed it so the VPN uses a different username and in a few minutes of testing, that seems to workaround it at least.

1
  • 1
    I am seeing the exact same behavior. Same username on local AD as on VPNed network AD, different password. I regularly need to have the AD account reset for too many failed login attempts. I cannot change either AD account, so am stuck with living with this issues, though will try the suggestions mentioned above.
    – user157686
    Feb 5, 2013 at 15:00
0

Windows can sometimes record a failed login if a station attempting to log in and the server can't reach a mutually agreeable encryption setting, or worse, agree on one mistakenly (thus generating a login failure) before falling back to another one.

By default Windows 7 is set to "Send NTLMv2 response only". The Server 2003 server may be set to "Send LM & NTLM - use NTLMv2 session security if negotiated". A bug in the protocol negotiations can produce the errored logins you are experiencing. The hotfix your friend mentioned is probably this one:

http://support.microsoft.com/kb/893318

As a workaround (and probably why that other Win7 machine is working) you can change your local security policy to work around it:

Search for "Local Security Policy". You can also find it under admin-tools in the Control Panel. Open it.

Browse to Local Policies -> Security Options.

In the list will be "Network Security: LAN Manager Authentication Level".

It will probably be set to "Send NTLMv2 response only". Change it to "Send LM & NTLM - use NTLMv2 session security if negotiated".

There is a good reason why Microsoft changed the default on this, so once the VPN server gets updated you'll want to set it back.

1
  • That looks like an interesting hotfix, but the server is not an IAS server - the VPN ends at a hardware firewall, so it doesn't look like the hotfix describes quite the same situation. Oct 14, 2010 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .