0

I have an issue where users are randomly unable to log onto a certain computer.

We have Windows Server 2003, and XP for the clients.

The error that appears is the generic "Wrong username or bad password" when the user tries to log in, although it seems as though it happens after the username/password dialogue box dissapears (So the user inputs credentials, presses enter, it disappears then the error appears, then the credential box re-appears).

Within Event Viewer, on the client, it says "User cannot log onto this computer" (Or words to that effect).

I have checked that the account is not locked, does not have restrictions in the 'Log on to..' properties, and that the account has not expired.

The user can however log on using a different client.

This has happened about 3 times quite recently with different users.

Does anyone know how I can further investigate this, or have a solution?

UPDATE:

Sorry for the delay on the update, but the error miraculously 'fixed itself' and I had to wait for it to happen again to investigate further. I have also found a solution, which I have posted also.

Event id: 553
Logon Failure: 
Reason: User not allowed to logon at this computer 
User Name: <user name> 
Domain: <domain name>
Logon Type: <logon type>
Logon Process: <process>
Authentication Package: <package> 
Workstation Name: <workstation name>
1
  • 1
    The exact message from the Event Log on the client PC would be helpful. Jul 7, 2014 at 10:07

2 Answers 2

0

This behavior may occurs when NTLM version 2 (NTLMv2) is used for authentication and when there is a time difference of more than 30 minutes between the local Windows XP computer and the remote window server.To work around this behavior, synchronize the time on both the Windows XP workstation and on the remote Windows XP or Windows Server 2003 computer.

2
  • 1
    Ick. NET TIME isn't the way to handle time sync in Active Directory environments. You want a working Windows Time Service infrastructure. Jul 7, 2014 at 10:06
  • Also, I forgot to mention, that other users can log onto the client in question. So this would lead me to believe that it is not a time issue. Thanks for the input though Jul 7, 2014 at 10:08
0

The cause of my problem was the old CrashOnAuditFail key ...

So within regedit, I just changed:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\CrashOnAuditFail

Back to value 1, and restarted the client.

The CrashOnAuditFail key that has it's value changed to 2, may also be in one of the numbered CurrentControlSet teirs, so I'd check them too (CurrentControlSet001, CurrentControlSet002 etc)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .