Tag Info

Hot answers tagged

10

This really piqued my interest. I was able to replicate your findings in my lab with the same pattern of results that you describe. I used Procmon to to try to see what changes are made and almost gave up until I saw the following: That shows lsass.exe (Local Security Authority) writing to the local SAM and making a change(s) to the built-in Guest account ...


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...


6

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: http://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using


6

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPN's. Is your domain's FQDN us.mycompany.local? In Active Directory, each user has two UPN's: Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN ...


6

The problem is that your computer is not a domain member, so domain users have no permissions or access to your computer. The solution, of course, is to join your computer to the domain so that domain users (like your domain user) actually have permissions.


5

I was also having this same issue and found the solution here: http://social.technet.microsoft.com/forums/en-US/itprovistanetworking/thread/275599f0-6239-46a5-8245-50a5c13a2713/ You'll need to locate your VPN connections .pbk file. You can find it here: C:\Users\{WindowsLogin}\AppData\Roaming\Microsoft\Network\Connections\Pbk Or if you have it set ...


5

Two examples: Constrained delegation enables impersonation without having the user's credentials or authentication token. For an example, see this answer. In a more typical meat-and-potatoes unconstrained delegation scenario, whether it is windows integrated authentication or forms authentication, having delegation access to a user's authentication ...


5

Try this: change: <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" /> to <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" /> With the response mode 'File' IIS just loads the content of that file ...


5

You probably haven't configured WMI and DCOM for remoting on your client and server. John Howard wrote a series of blog articles explaining how to connect to a non-AD integrated hyper-V server remotely and several of these steps apply to doing the same in hyper-V as well. The simplest way to do that is to download the Hyper-V remote management configuration ...


4

In IIS (website props): Uncheck "Anonymous access" check "Integrated Windows authentication" and "Basic authentication" Make sure that in web.config you have: <identity impersonate="true"/> <authentication mode="Windows" /> The default is set to: <authentication mode="None" /> If "Someone calls webservice" is not on the ...


4

If the login is tied to the domain account, it should be fine because at the basic level it depends on the SID of the user and not the actual username. If the new username doesn't work, you may have to reset the token cache with this command: DBCC FREESYSTEMCACHE('USERSTORE_TOKENPERM');


4

From Microsoft KB 243330 Well-known security identifiers in Windows operating systems SID: S-1-5-32-545 Name: Users Description: A built-in group. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the ...


4

No, mixed mode does not require both, obviously - it requires either one. Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have? Create a new Login for DOMAIN\cnorton and map the user to some databases. CREATE ...


4

This article explains it well They are two different things. The Local System Account should contain the token for NT Authority\System, so that doesn't explain why you're having issues, but there are certainly differences between the accounts. They are not synonymous for each other. This caveat could explain what you're seeing: A service that runs in ...


4

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


3

The short answer: It depends. Windows Authentication is considered to be a best practice, but I have a number of situations in my environment where it simply isn't practical for various reasons. I wouldn't run either the service or SQL Server with NetworkService - it has too many unnecessary permissions. Since you're on a domain, create domain accounts ...


3

I had a similar situation with a client. The domain controllers were misconfigured (in NT4 mode), and IE had the "Enable Windows Integrated Security" option checked. What IE does when in Windows Integrated Security mode is it tries the request with a Windows 2000+ mode AD/Kerberos ticket. When the web server fails to authenticate the ticket, it fails back ...


3

You will need to log onto the SQL server with the SA account (SQL authentication) and remove the SERVERNAME\Administrator account and re-add it back. When you promoted the machine to a DC, and then demoted it, your Administrator account SID would have been reset. So the SID the SQL server has to identify the administrator is not valid anymore.


3

Try adding the new site URL to the trusted sites list in IE and give it another shot.


3

From what you mentioned, it seems there are two machines: A. Your home server with SQL 2008 R2. B. Your laptop with SQL Management Studio. Points to remember: What edition of SQL 2008 R2 did you install on the home server? Is it full version (STD/ENTERPRISE) or express? If it is full version, then by default, the default instance is installed. Else ...


3

The Windows Local Security Authority (LSA) caches SecurityIdentifiers (SIDs). These cached values will retain the old username. More information: The LsaLookupSids function may return the old user name instead of the new user name if the user name has changed on a domain controller http://support.microsoft.com/kb/946358


3

By default anonymous users use IUSR account when connecting to the site. You can change this user to a different user (who might have different privileges) and all anonymous users will use that account when connecting to the site, instead of the default IUSR account. From MSDN on when to specify a different user for Anonymous Authentication If your ...


3

PhoneFactor might do the trick: http://www.phonefactor.com/solutions/terminal-services-authentication


3

It sounds like you need to use the "Active Directory Sites and Services" snap-in to define the subnets, physical locations (known as "Sites") with well-connected subnets, and connections between sites (known as "Site Links") that make up the physical network underlying your Active Directory (AD) so that your domain controllers can make good replication ...


3

When a Windows machine joins an AD domain, a computer account is created in AD. Similar to a user account, this account has a password, although its managed by the computer, so you wouldn't normally even be aware of it, unless you had knowledge of the inner workings of AD. What happens in your case is something like this: You take a snapshot of your VM on ...


3

Did you also look at the following setting for Firefox? http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/ Navigate to about:config Search for network.automatic-ntlm-auth.trusted-uris Add your URIs. Separate multiple entries with commas.


3

SQL Server is an application. Windows Authentication and SQL authentication are two different methods for authenticating to SQL Server as an application. Both types require a user principal to be defined/created with some level of access. That's what a login is. You can create a login of either type but you must create the login and grant it some level of ...


3

This appears to be a duplicate of http://stackoverflow.com/questions/434272/iis7-overrides-customerrors-when-setting-response-statuscode , but I'm too new on Server Fault to flag this. My take: I had a similar problem when using Mediawiki on an IIS server box. When you browse to a non-existing page in Mediawiki. It sends back a special wiki page that says ...


3

The problem looks similar to this issue here: http://stackoverflow.com/questions/168946/iis-returning-old-user-names-to-my-application For clarification here is the solution: http://support.microsoft.com/kb/946358


3

Not sure of your environment setup, but this can be handled with Group Policies. Chrome and Chromium both support the AuthServerWhitelist from GPO. More information and a template for Chrome GPO's can be found here: http://www.chromium.org/administrators/policy-list-3



Only top voted, non community-wiki answers of a minimum length are eligible