Tag Info

Hot answers tagged

11

This really piqued my interest. I was able to replicate your findings in my lab with the same pattern of results that you describe. I used Procmon to to try to see what changes are made and almost gave up until I saw the following: That shows lsass.exe (Local Security Authority) writing to the local SAM and making a change(s) to the built-in Guest account ...


8

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPN's. Is your domain's FQDN us.mycompany.local? In Active Directory, each user has two UPN's: Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN ...


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


6

The problem is that your computer is not a domain member, so domain users have no permissions or access to your computer. The solution, of course, is to join your computer to the domain so that domain users (like your domain user) actually have permissions.


6

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: http://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using


5

Two examples: Constrained delegation enables impersonation without having the user's credentials or authentication token. For an example, see this answer. In a more typical meat-and-potatoes unconstrained delegation scenario, whether it is windows integrated authentication or forms authentication, having delegation access to a user's authentication ...


5

Try this: change: <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" /> to <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" /> With the response mode 'File' IIS just loads the content of that file ...


5

You probably haven't configured WMI and DCOM for remoting on your client and server. John Howard wrote a series of blog articles explaining how to connect to a non-AD integrated hyper-V server remotely and several of these steps apply to doing the same in hyper-V as well. The simplest way to do that is to download the Hyper-V remote management configuration ...


5

I was also having this same issue and found the solution here: http://social.technet.microsoft.com/forums/en-US/itprovistanetworking/thread/275599f0-6239-46a5-8245-50a5c13a2713/ You'll need to locate your VPN connections .pbk file. You can find it here: C:\Users\{WindowsLogin}\AppData\Roaming\Microsoft\Network\Connections\Pbk Or if you have it set ...


4

In IIS (website props): Uncheck "Anonymous access" check "Integrated Windows authentication" and "Basic authentication" Make sure that in web.config you have: <identity impersonate="true"/> <authentication mode="Windows" /> The default is set to: <authentication mode="None" /> If "Someone calls webservice" is not on the ...


4

If the login is tied to the domain account, it should be fine because at the basic level it depends on the SID of the user and not the actual username. If the new username doesn't work, you may have to reset the token cache with this command: DBCC FREESYSTEMCACHE('USERSTORE_TOKENPERM');


4

This article explains it well They are two different things. The Local System Account should contain the token for NT Authority\System, so that doesn't explain why you're having issues, but there are certainly differences between the accounts. They are not synonymous for each other. This caveat could explain what you're seeing: A service that runs in ...


4

Did you also look at the following setting for Firefox? http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/ Navigate to about:config Search for network.automatic-ntlm-auth.trusted-uris Add your URIs. Separate multiple entries with commas.


4

No, mixed mode does not require both, obviously - it requires either one. Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have? Create a new Login for DOMAIN\cnorton and map the user to some databases. CREATE ...


4

From Microsoft KB 243330 Well-known security identifiers in Windows operating systems SID: S-1-5-32-545 Name: Users Description: A built-in group. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the ...


4

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


3

SQL Server is an application. Windows Authentication and SQL authentication are two different methods for authenticating to SQL Server as an application. Both types require a user principal to be defined/created with some level of access. That's what a login is. You can create a login of either type but you must create the login and grant it some level of ...


3

PhoneFactor might do the trick: http://www.phonefactor.com/solutions/terminal-services-authentication


3

It sounds like you need to use the "Active Directory Sites and Services" snap-in to define the subnets, physical locations (known as "Sites") with well-connected subnets, and connections between sites (known as "Site Links") that make up the physical network underlying your Active Directory (AD) so that your domain controllers can make good replication ...


3

When a Windows machine joins an AD domain, a computer account is created in AD. Similar to a user account, this account has a password, although its managed by the computer, so you wouldn't normally even be aware of it, unless you had knowledge of the inner workings of AD. What happens in your case is something like this: You take a snapshot of your VM on ...


3

This appears to be a duplicate of http://stackoverflow.com/questions/434272/iis7-overrides-customerrors-when-setting-response-statuscode , but I'm too new on Server Fault to flag this. My take: I had a similar problem when using Mediawiki on an IIS server box. When you browse to a non-existing page in Mediawiki. It sends back a special wiki page that says ...


3

The problem looks similar to this issue here: http://stackoverflow.com/questions/168946/iis-returning-old-user-names-to-my-application For clarification here is the solution: http://support.microsoft.com/kb/946358


3

Not sure of your environment setup, but this can be handled with Group Policies. Chrome and Chromium both support the AuthServerWhitelist from GPO. More information and a template for Chrome GPO's can be found here: http://www.chromium.org/administrators/policy-list-3


3

--- This is a really high level summary over-view, don't expect anything technical here --- Let's get started: What is this sharing of username and password called? "By Design"... or more specifically, "pass-through authentication". How come identical name and authentication between two windows PCs on same network works? Because this is ...


3

Use double quotes instead of single quotes: C:\>mkdir foo C:\>icacls 'C:/foo' /grant:r 'Users':f 'Users': No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files C:\>icacls "C:/foo" /grant:r "Users":f processed file: C:/foo Successfully processed 1 files; Failed processing 0 files I ...


3

Kerberos works but it may be easier to do it with LDAP alone in this case. Put the following in your VirtualHost settings for the wordpress site. With this config ldap.company.com needs to resolve to your AD Global Catalog(s) and you need an ID ldap-auth-svc with a password of Secretpassword so Apache has rights to access AD to authenciate the users. You may ...


3

You may want to confirm if the security connection is NTLM or Kerberos. If it is reverting to NTLM, the connection will be anonymous. There is a group policy that enables using the computer identity when NTLM is used. Network security: Allow Local System to use computer identity for NTLM ...


3

Here are a few links from Microsoft that show the data you are requesting. Note that the dynamic ranges for 2003 and 2008 have changed so if you have a mixed environment you might need to open both ranges or make them static. http://support.microsoft.com/kb/179442 http://support.microsoft.com/kb/224196 will let you limit the dynamic range to help with ...


3

If the machine has been disconnected from the network longer than your Active Directory (AD) forest's tombstone lifetime be sure not to allow the machine to actually replicate with any existing domain controllers (DCs). (You can get the tombstone lifetime by running dsquery * "cn=directory service,cn=windows ...



Only top voted, non community-wiki answers of a minimum length are eligible