Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been using TS Gateway to permit remote access for our staff for a few months now, and all has been well. Users either connect to a traditional terminal server desktop or hit our website and start an TS RemoteApp application- in both cases the connection is routed through a TS Gateway.

However I came into work this morning to find that has stopped authenticating users through TS Gateway, each time returning "The logon attempt failed" as seen in the image even though the credentials are correct.

alt text

It should be noted that everything works fine if the Gateway is taken out of the equation, it's the TS Gateway component that is causing these problems.

Users experience this problem whether they connect through XP SP3, Vista or 7.

On the server a total of 4 entries appear in the Windows security log at exactly the same time for each failed logon attempt: two 4624 "An account was successfully logged on" messages for the user, immediately followed by two 4634 "An account was logged off"s. This suggests that the server is accepting the credentials as correct, then booting the user off. Nothing at all is recorded in the NPS and Terminal Server logs.

A reboot doesn't change things. Neither does completely removing and reinstalling the NPS and Terminal Server roles. I'm baffled as to how this can happen suddenly without warning.

Any suggestions would be greatly appreciated.

share|improve this question
    
I'm coming from left field here because I don't know much about this, but maybe it's a credential issue with the Windows Service that is running the TS Gateway? Is it possible that the account for the Windows Service changed it's password or has been locked out? JFV –  JFV May 15 '09 at 13:10
    
Since I didn't get anywhere with this I've had to build up another TS Gateway box. However, since they are VMs I've kept the old problematic system to try out any other suggestions on - it would be good to get to the bottom of this. –  user2059 May 18 '09 at 14:07
    
I had the same problem, thought the NPS Policy's were the problem. In ISS --> RPC --> Authentication --> Enable Windows Authentication –  user68442 Jan 27 '11 at 11:26
add comment

10 Answers

This problem has been plaguing me for months on an SBS 2008 machine, but has never been critical enough to go to crazy measures to fix.

After resorting to uninstalling and reinstalling the TS Gateway service and it still not working, I went to IIS Manager → Sites → SBS Web Applications → Rpc → Authentication and found only "Basic Authentication" was enabled.

Though details on this particular error are scarce online, I have seen that Outlook Anywhere seems to change IIS Authentication schemes. Since this is SBS, I figured Exchange and TS Gateway might be fighting over the authentication setting.

I enabled "Windows Authentication" then ran an IIS reset. When IIS came back online, I was able to connect via TS Gateway to two servers and at least one workstation. I connected and disconnected multiple times and it had no problems.

I can't guarantee this is permanent, but I'm definitely hoping.

EDIT: Since making this change, I haven't had any problems with TS Gateway.

share|improve this answer
add comment

Ok here is the answer?

2k8r2 and iis7

TSGateway repeatedly asks for credentials but does not log in...

Turns out that TSGateway doesn’t do the connection and authentication, IIS does. Surprise, Ya I know….

TSGateway only filters and routes.

So, Now, what part of IIS does the connection and authentication for TSGateway? I don’t know. And apparently, no one else really does either. But if you mess with the Authentication settings of RDWEB, RPC, RPCWCERT, Default WEB SITE, Authdiscover, you can make it work…

This is a good article. But as you see, it’s a shot in the dark with them also.

NOTE: Apparently, redirection of the Default Web Site breaks communication to RDWeb and therefore TSGateway.

HTTP – HTTPS redirection…

It looks like my default web site came as HTTPs but I wanted it to be reachable from HTTP users. So I created a redirection web site to redirect HTTP requests to the Default Web Site as HTTPS. Which works great but it stopped my TSGateway authentication. (I think it was because port 80 was being used by the redirection web site. And for some reason, RDWEB uses port 80 as well as 443 for communications…)

By the way, if you turn off Require SSL in SSL Settings on the default web site in IIS, it does work correctly and does the same thing…

Anyhow, start buy getting RDWEB working correctly then, work on TSGateway.

RDWEB should have only: Anonymous Authentication Enabled AutoDiscovery should have Anonymous, Basic and Windows Authentication Enabled. OWA: Basic Only. RPC: should have: Basic and Windows Authentication. RPCWCert: Should not have anything enabled. At lease those are the settings in My setup…

Good Luck.

Robert

share|improve this answer
    
From PiBaSe, Sorry to edit your answer, but i see no other way to add a little info in this thread/post. I was running Exchange 2010 with OWA and RdWeb on 1 server. The exchange kept changing the authentication for the rpc to only basic every 5 minutes or so.. To stop this from happening i could solve it by running the following command from the exchange shell, hope it helps someone: get-outlookanywhere | set-outlookanywhere -IISAuthenticationMethods: Basic, Ntlm –  Chris S Dec 16 '12 at 15:47
add comment

The Terminal Services Gateway windows service kept failing for us.

In the absence of anything useful in the event logs, I just get task scheduler to "net start tsgateway" a few times every hour. Horrible, but zero complaints ever since.

share|improve this answer
    
Ha, I also had that problem when I first set this up - the end user would see "terminal sevices gateway server is temporarily unavailable"? The service appears to be started fine, a restart of the service doesn't solve my problem either. –  user2059 May 15 '09 at 14:03
add comment

I had a similar problem. I found I had to edit IIS Manager → Sites → SBS Web Applications → Rpc With Cert→ Authentication and added Windows Authentication. Then performed and IISRESET and all worked as it should.

share|improve this answer
add comment

I had a similar issue. The Gateway Login Screen just kept poping up. The server security logs showed a special priveleges logon, a logon and a logoff for every attempt. The gateway logs showed nothing.

After trying everything, I noticed that the area at the bottom of the gateway logon screen that should be showing the domain was blank. I added the domain to the username logon screen: domain\username and voila, it all works as it should.

That was a waste of about 4 or 5 hours of my life searching for solutions and trying complicated fixes... Hope it saves someone else some time...

share|improve this answer
add comment

If you're having this issue on SBS 2008, I suggest using a combination of the SBS 2008 Best Practices Analyzer and the SBS Console's "fix my network" wizard (Network -> Connectivity -> Fix my network). SBS is finicky and will sometimes override manually adjusted settings so it's best to use the wizards when possible.

In my case, BPA said to run "get-outlookanywhere |set-outlookanywhere -iisauthenticationmethods basic, ntlm -clientauthenticationmethod basic" in the Exchange Management Shell and the "fix my network" wizard also made a correction.

share|improve this answer
add comment

Had the same exact issues as the original post. I was also redirecting the default web site to /RDWeb/Pages/en-US, once I took that redirect off everything worked as normal.

I'm bewildered how this even caused the issue in all honesty.

share|improve this answer
    
Terminal Services runs over IIS on Port 80. Messing with it's settings (a la redirects) will cause problems. –  Chris S Jan 5 '11 at 20:29
add comment

I had an MS support ticket going so I had them look at this. They simply changed outlook anywhere to NTLM and VIOLA!

share|improve this answer
add comment

Same problem for me too, SBS2008 suddenly started reporting "login failed" whenever the TS Gateway was used. Found that the RPCwithCert site in IIS had no authentication method, ticked Windows Authentication and it works again now....

share|improve this answer
add comment

For me, I got everything setup for SSO, then I made a few changes and it broke. I could get into the RemoteApps site, but when trying to launch an application I got prompted for my credentials and "the logon attempt failed" at the bottom of the logon window. Thanks to Robert's post from above, I found out that it was the redirect I put in IIS7. My setup is one server acting as Gateway, Broker, and Web Access. I left everything to run under "Default Web Site". To expand on Robert's post, I left the redirect in place, but checked the "Only redirect requests to content in this directory (not subdirectories)" since I want requests to the root site to hit RDWeb and this works perfectly for me.

share|improve this answer
add comment

protected by Community Sep 22 '11 at 19:29

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.