Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently we have a two DC Windows Server 2008 R2 Active Directory domain with about 200 users. Next to it, we have 9 loadbalanced Windows 2008 R2 servers. While RDP-connecting to these servers, quite often users are required to enter their credentials twice. The first time, users will get the message that the username or password is incorrect, even when they are correctly typed. When they do the samething right after the error message, the login succeeds.

Not log ago, we've installed a tool called AD Audit Plus, which logs and e-mails all the logon failures. Every time the first RDP-logon fails, we get two messages about Kerberos pre-authentication failure on a Bad password-event. One from the loadbalanced server and one from the domain controller.

I've done a complete AD- and DNS-health check and googled arround, but didn't come to a solution yet.
Does somebody have any experience with this issue?

Thanks, Vincent

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

In my experience, Kerberos Pre-Auth failures are usually caused by time being out of sync between the client and the domain controller. Have to verified your NTP configurations are all up to snuff? Any time related errors in the event logs? Is there something that would be changing the time on the load balanced RDP servers (which are the clients in this case)?

share|improve this answer
    
Hi Ryan, indeed it looks like the time sync was messing with logons. We synced our AD DC's with a generic time server (pool.ntp.org) and then all the clients with the DC time server. After that, the issue disappeared. Thanks for your help. –  Vincent Kuiper Oct 22 '13 at 10:02
    
Glad to here it. Consistent time is critical to a well functioning AD. I'm not sure how large your organization is, but you might check if they have a dedicated NTP server you can sync your DC's to rather than going across the WAN to pool.ntp.org. –  Ryan Bolger Oct 28 '13 at 0:11
    
That's right. I've set up every AD client to sync the time with the domain controller. Then, the domain controller synchronizes it's time with pool.ntp.org. That should do it. –  Vincent Kuiper Oct 29 '13 at 9:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.