Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been stuck on this for a while, not sure what permission I'm missing. I've got domain A and domain B, A trusts B, but B does not trust A. I'm trying to run a service in domain A with a user account from domain B and I keep getting Access is Denied. I'm using the FQDN after the username and the password is correct. The user account from domain B is a local administrator on the domain A server, the user account has the logon locally, and as a service permissions. Must. Get. This. Working.

enter image description here

Update:

I found something interesting in the logs I must have missed. This ought to get me pointed in the right direction. Event ID: 40961 - LsaSrv : The Security System could not establish a secured connection with the server ldap/{server fqdn/fqdn@fqdn} No authentication protocol was available.

I've found a few fixes for 40961 but nothing has worked so far. I've verified reverse lookup zones. nslookup resolves the correct dc properly. still workin' at it.

Upadte:

In response to Evan;

I ran " runas /env /user:ftp_user@fqdn "notepad" " then entered the users password and notepad came up. It seems to work successfully.

share|improve this question
2  
Check what the failure event in the security log looks like? –  Shane Madden Oct 26 '12 at 18:34
1  
Just a random guess, but perhaps the Access is Denied has nothing to do with the username you're using, but rather that you don't have permission to modify that service. Can you change anything else in there (like the startup type?) –  Mark Henderson Oct 26 '12 at 19:12
    
I'm new to ServerFault, so I'm not sure if I'm responding in the right place, sorry about that. I found something interesting in the logs I must have missed. This ought to get me pointed in the right direction. Event ID: 40961 - LsaSrv : The Security System could not establish a secured connection with the server ldap/{server fqdn/fqdn@fqdn} No authentication protocol was available. –  EWood Oct 26 '12 at 19:29
    
@EWood You should edit your question when adding information so that the question is always complete. You can then add a comment addressing whoever asked for the information so that they get notified. –  mgorven Oct 26 '12 at 22:56
    
What happens when you try to do a "RUNAS /user:P_User@prod... cmd" on that machine? –  Evan Anderson Oct 26 '12 at 23:29
show 3 more comments

1 Answer

This issue is now resolved. The problem is visible in the screenshot. Windows tries to use the UPN for the user account if you dig your user out of AD with the Browse button. This fails every time even with the right user and password. Simply using the SAM format (Domain\User) works. So simple, yet so annoying. Can't believe I missed this.

Thanks to everyone who helped.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.