8
votes
2answers
374 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
3
votes
1answer
2k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
2
votes
1answer
454 views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
1
vote
1answer
608 views

Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN

We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server. It works fine when ...
0
votes
2answers
425 views

RDP in 2008 R2 domain no longer working - possible Kerberos issue

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
0
votes
1answer
445 views

Get a user's kerberos ticket updated over VPN

We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN. Recently group membership was changed for many of these users and ...
2
votes
2answers
677 views

Is there a Kerberos testing tool?

I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way. I want to do ...
3
votes
1answer
3k views

Impact of increasing the MaxTokenSize for Kerberos Tickets

Recently by migrating form Netware to Windows file servers we have ended up creating a boat load of AD groups. We have now run in to some problems with authenticating and gaining access to resources. ...
2
votes
2answers
437 views

Active Directory Integration over VPN

I recently started working as a network admin for a company who has 2 locations and we use a VPN to connect them. We need to set up an Active Directory and Exchange Server at the second location to be ...
10
votes
2answers
2k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
1
vote
1answer
2k views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
3
votes
2answers
559 views

Multiple SPNEGO authenticated web servers on one host name

I was trying to set up a Java service using the SPNEGO servlet filter and a listen port of 8080 for authentication on a host that is also running web applications hosted in IIS7. I followed the ...
1
vote
1answer
1k views

NTLM token sent instead of Kerberos ticket

I am trying to implement kerberos SSO in our network using spnego on a tomcat server. We have created an account (TCNKRBGINA) on the domain for the preauthentication, and setspn'ed it to the http ...
4
votes
2answers
688 views

Double Hop Window Authentication

I've got a problem getting Windows Authentication (Kerberos) to work when passing credentials from the user, to IIS then from IIS to SQL. I have setup SPN's for SQL, and set the IIS server account up ...
1
vote
1answer
980 views

Failure to create keytab file using msktutil on Centos to W2K8

I'm trying to setup a centos 5.5 squid server to authenticate against a windows 2008 DC. I have followed the tutorial: ...
3
votes
2answers
11k views

Does kerbtray.exe not exist for windows server 2008

I can not find a valid kerbtray.exe for windows server 2008. I can only find for 2000 and 2003. Does it not exist or it is just replaced with something else?
3
votes
1answer
47 views

DO i need anything else like roles to install kerberoes

I want to test or install Kerberoes for authentication. Is it a part of AD DS or a stand alone application which i can install on window server 2008 Do i need anything else to make it working
4
votes
1answer
12k views

Create SPN with setspn.exe - Insufficient access rights

On a Windown Server 2008 Domain Controller, I'm attempting to add a Service Principal Name (SPN) to a user account 'Postmaster' in order to enable Kerberos authentication from a Communigate email ...
14
votes
3answers
32k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an ...
1
vote
3answers
1k views

Windows Vista and 7 crossrealm authentication MIT Kerberos

I'm using Windows Server 2008 and Windows Vista and 7 for cross realm authentication using MIT Kerberos 1.6 but when i try to login with a user the KDC answers: (wireshark output) error_code: ...