Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 R2 Terminal Server with 5 cals. I have User1 to 5 set up with RDP allowed from all OS.

All the Users can RDP from all over the world. The event log shows this. These are customer logins but there is one that works when it is logged from any other place except the customers own site. They were able to log in for a few days but now they are getting an error. I believe that they had a straight connection at first but now they cannot connect.

I have tested this and I can log in via a tablet, via Wireless connection. I have also had the connection tested from Asia and it works find with the correct password. Their infrastructure is from a server, they connect to another server that can run the application Remote Desktop to connect to our server. They then go through a firewall-router (linux firewall) that allows all outgoing flows. There is just incoming flows that are blocked. I can post the event log :

Successful log on :

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          07/11/2012 11:17:04
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WLXXXXXX
Description:
An account was successfully logged on.

Subject:
  Security ID:        SYSTEM
  Account Name:       WLXXXXXX$
  Account Domain:     XXXXX
  Logon ID:       0x3e7

Logon Type:           10

New Logon:
  Security ID:        WLXXXXXX\User1
  Account Name:       User1
  Account Domain:     WLXXXXXX
  Logon ID:       0xb501b0
  Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
  Process ID:     0x424
  Process Name:       C:\Windows\System32\winlogon.exe

Network Information:
  Workstation Name:   WLXXXXXX
  Source Network Address: ??.??.??.???
  Source Port:        33224

Detailed Authentication Information:
  Logon Process:      User32 
  Authentication Package: Negotiate
  Transited Services: -
  Package Name (NTLM only):   -
  Key Length:     0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Event Xml:
4624 0 0 12544 0 0x8020000000000000 123115 Security WLRDPSVR S-1-5-18 WLXXXXXX XXXXX 0x3e7 S-1-5-21-3690008040-1934288712-2518075725-1000 User1 WLXXXXXX 0xb501b0 10 User32 Negotiate WLXXXXXX {00000000-0000-0000-0000-000000000000} - - 0 0x424 C:\Windows\System32\winlogon.exe ??.??.??.?? 33224 I have changed the server name and ip number with XXXXXXX.

This is the log when they try and log on now

Log Name: Security Source:
Microsoft-Windows-Security-Auditing Date: 21/11/2012 09:08:01 Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer:
WLXXXXXX Description: An account failed to log on.

Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: User1 Account Domain: PUSHMAIL-P1WX4

Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a

Process Information: Caller Process ID: 0x0 Caller Process Name: -

Network Information: Workstation Name: PUSHMAIL-P1WX4 Source Network Address: - Source Port: -

Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Event Xml:
4625 0 0 12544 0 0x8010000000000000 148408 Security WLXXXXXX S-1-0-0 - - 0x0 S-1-0-0 User1 PUSHMAIL-P1WX4 0xc000006d %%2313 0xc000006a 3 NtLmSsp NTLM PUSHMAIL-P1WX4 - - 0 0x0 - - -

I can see that they are now logging in with a different domain but I don't know how to get around this just for them Thanks in advance

share|improve this question
    
It's very early here, so sorry if I'm being totally dense, but does it not work if they type CORRECTDOMAINNAME\Username into the Remote Desktop client (When it asks for a username / password)? –  Dan Nov 23 '12 at 9:00
    
Hi No, I have had them type in WLXXXXXX\User1 and then the password but they are still not getting in –  Sharon Cook Nov 23 '12 at 9:09
    
Try using UPN instead (user@domain.tld) –  pauska Nov 23 '12 at 11:04
    
Hi, they have tried that and still not got in thanks –  Sharon Cook Nov 23 '12 at 12:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.