Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My workstation is under Linux. I have an Active Directory domain controller + Radius server on Windows 2008. I can verify user account 'radius-01' using 'radtest' tool:

    $ radtest -t pap radius-01 password123 1812 password123
    Sending Access-Request of id 98 to port 1812
            User-Name = "radius-01"
            User-Password = "password123"
            NAS-IP-Address =
            NAS-Port = 1812
    rad_recv: Access-Accept packet from host port 1812, id=98, length=84
            Framed-MTU = 1344
            Framed-Protocol = PPP
            Service-Type = Framed-User
            Class = 0x537004f00000013700010200ac1c0...

I have joined my Linux PC to Active Directory domain ARB-HRK using Samba:

    [root@shev-arb]# net ads testjoin
    Join is OK

I can dump machine password:

    [root@shev-arb]# tdbdump /var/lib/samba/private/secrets.tdb
    data(15) = "yGgXJsquRnpT0g\00"

How can i authenticate my machine account on Radius server?

Do anybody know any tools for this, like:

    radtest   shev-arb$ yGgXJsquRnpT0g 1812 password123

(this command fails)

share|improve this question
up vote 0 down vote accepted

In a Windows Domain, Machine Authentication using machine secret is disabled by default for legacy systems that use MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as authentication method such as the cases with IKEV1 PAP. In such cases you might encounter DPC Authentication fails at the NPS with error 0xc0000199 (NO_LOGON_WORKSTATION_TRUST_ACCOUNT).

To enable machine authentication for a specific computer account. Do the following:

  • Edit the UserAccountControl attribute such that WORKSTATION_TRUST_ACCOUNT should be removed and NORMAL_ACCOUNT should be added to the value.
  • If the existing value of the UserAccountControl is x then compute update the value to (x-4096+512) to make machine authentication work.

Follow the instruction given in this KB article: or:

  1. Run adsiedit.msc on the domain controller
  2. Expand the tree and Select the Computer Leaf, it will be displayed as CN=Hostname
  3. Right click and select Properties
  4. In the properties window select the userAccountControl attribute. Double click to edit.
  5. update the number by deducting 3584 from the existing value.
  6. Press OK to close the edit and OK to close the properties Dialog.

Revert to normal setting once the testing is complete.

radtest -t mschap  'host/' yGgXJsquRnpT0g 1812 password123
Sending Access-Request of id 139 to port 1812
rad_recv: Access-Accept packet from host port 1812, id=139, length=142
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.