Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Have you ever seen authentication failure happening consistently, unless the offending user account is locked in AD?

I am entering my credentials to access a network share that I have authorisation to. However, the following happens:

Scenario 1

  1. Attempt to log in to the location
  2. Login failure.
  3. I cannot enter the folder.

Scenario 2

  1. Lock out user account by entering password wrong too many times
  2. Attempt to log in to the location
  3. Login success. I can enter the folder.

FYI I know for certain that the username and password is correct, and the user is authorised to access the share, and the share is reachable by the laptop. The network share is running samba.

The problem does not happen if we access the network share using the IP address rather than the alias.

Any ideas?

share|improve this question
    
I'm going to edit your question. Scenarios 3 and 4 are the same as scenarios 1 and 2. You're just repeating the same steps and the result is the same. –  joeqwerty Dec 7 '12 at 15:08
    
@joeqwerty ok, the method in my madness was to give confidence to the dear reader that there was a relationship between locked AD account and logging in to samba –  rikAtee Dec 7 '12 at 15:17
    
I think we get it. Hold tight for answers forthcoming (hopefully). –  joeqwerty Dec 7 '12 at 15:21
1  
Perhaps when the user account is locked out, you're seeing an offline cached version of the network folder? –  Ryan Ries Feb 10 '13 at 19:27
    
@RyanRies interesting. I will check this. –  rikAtee Feb 10 '13 at 19:30

1 Answer 1

This is because Windows 7 and Server 2008 R2 uses NTLMv2 authentication by default. To enable auto negotiation (NTLMv2 if available or then NTLMv1) please follow this instructions:

  1. Runs secpol.msc on client side
  2. Click Local Policies > Security Options > Network Security: LAN Manager authentication level.
  3. Click Send LM & NTLM - use NTLMv2 session security if negotiated.
share|improve this answer
1  
Actually, Windows 7 and 2008R2 try and use Kerberos by default, then they fail back to NTLMv2. If this really is the problem, it would be preferable to fix the Samba server(s) rather than lower the security on the Windows side. –  MDMarra Feb 10 '13 at 19:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.