Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently deployed a new remote access VPN system at my company, using a Cisco ASA 5510 as the concentrator. The protocol is L2TP-over-IPsec for maximum compatibility across clients, and authentication is handled by an RSA SecurID appliance. Everything works really well, except in one particular scenario:

  • User's workstation is a domain member
  • User is logging in to the local workstation as a domain user
  • User is connecting to the VPN using the same user name as the logged-in account
  • User attempts to access network resources, such as file shares or Microsoft Exchange

In this case, the user's account is locked in Active Directory almost immediately after attempting to connect to a network resource (i.e. opening Outlook).

I believe the issue is that Windows is attempting to use the credentials provided for connecting to the VPN. Because the username matches but the password does not, since it is actually a one-time password generated by the SecurID token, the authentication fails. Continuous attempts result in the account being locked out.

Is there any way to tell Windows to stop doing this? I've tried disabling the "Client for Microsoft Networks" option in the VPN properties, but it didn't help.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

There is a security policy setting that does specifically what I am looking for: Network access: Do not allow storage of passwords and credentials for network authentication. By enabling this setting, VPN credentials are not stored and therefore are not used to attempt to authenticate to network resources like shared files and Exchange.

Since the issue only affects domain-member workstations, applying this setting to all of them is a simple matter of setting it with Group Policy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.