Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients and non-controller 2008 R2 servers. After entering the password, we immediately get the following error message:

"The logon attempt failed."

No other information and nothing of value in the event log of the target computer. The only hint as to what's wrong comes from examining the security log on one of the domain controllers, which shows the following Audit Failure (4769) after each login attempt:

A Kerberos service ticket was requested.

Account Information:
    Account Name:       <user>@<domain>
    Account Domain:     <domain>
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Service Information:
    Service Name:       <user>@<domain>
    Service ID:     NULL SID

Network Information:
    Client Address:     ::ffff:<ip>
    Client Port:        64170

Additional Information:
    Ticket Options:     0x40810000
    Ticket Encryption Type: 0xffffffff
    Failure Code:       0x1b
    Transited Services: -

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.

From my own searching, this seems to have something to do with SPNs. However, this is an area that I've never touched before. Any ideas on how to get RDP working again?

Already tried applying all Windows Updates and restarting the client, target, and domain controllers. No effect. Other services, such as file sharing, are unaffected.

share|improve this question

2 Answers 2

Are you able to logon directly on the server with the account that leads to the error message?

Just to narrow down the problem you could try to disable Network Layer Authentication on one of your servers: Admintools -> Remote Desktop Session Configuration -> Security Layer: Set it to RDP

share|improve this answer
    
Logging in with the same account on the console works fine. Changing security layer to RDP or SSL (it was set to Negotiate) has no effect. –  VokinLoksar Mar 11 '13 at 12:28

spn´s are defined on the server side. As you cannot log on to all of your clients and servers the problem must be somewhere else. Did you our someone else change the group policy settings? (Allow to log on through Remote Desktop Services)

share|improve this answer
    
None of the group policies have been modified since February. I'm at a loss as to what could have caused this. No one was doing any work on the domain controllers or anything related to RDP. –  VokinLoksar Mar 11 '13 at 12:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.