Hot answers tagged

11

This really piqued my interest. I was able to replicate your findings in my lab with the same pattern of results that you describe. I used Procmon to to try to see what changes are made and almost gave up until I saw the following: That shows lsass.exe (Local Security Authority) writing to the local SAM and making a change(s) to the built-in Guest account ...


8

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPN's. Is your domain's FQDN us.mycompany.local? In Active Directory, each user has two UPN's: Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN ...


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


6

The problem is that your computer is not a domain member, so domain users have no permissions or access to your computer. The solution, of course, is to join your computer to the domain so that domain users (like your domain user) actually have permissions.


6

Use double quotes instead of single quotes: C:\>mkdir foo C:\>icacls 'C:/foo' /grant:r 'Users':f 'Users': No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files C:\>icacls "C:/foo" /grant:r "Users":f processed file: C:/foo Successfully processed 1 files; Failed processing 0 files I ...


6

Try this: change: <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" /> to <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" /> With the response mode 'File' IIS just loads the content of that file ...


6

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: http://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using


6

From Microsoft KB 243330 Well-known security identifiers in Windows operating systems SID: S-1-5-32-545 Name: Users Description: A built-in group. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the ...


6

Two examples: Constrained delegation enables impersonation without having the user's credentials or authentication token. For an example, see this answer. In a more typical meat-and-potatoes unconstrained delegation scenario, whether it is windows integrated authentication or forms authentication, having delegation access to a user's authentication ...


5

Did you set the policy for warning them of password expiration? Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Interactive logon: Prompt user to change password before expiration Here set the number of days (default is 14) before users start getting warnings that their password will expire... I ...


5

You probably haven't configured WMI and DCOM for remoting on your client and server. John Howard wrote a series of blog articles explaining how to connect to a non-AD integrated hyper-V server remotely and several of these steps apply to doing the same in hyper-V as well. The simplest way to do that is to download the Hyper-V remote management configuration ...


5

I was also having this same issue and found the solution here: http://social.technet.microsoft.com/forums/en-US/itprovistanetworking/thread/275599f0-6239-46a5-8245-50a5c13a2713/ You'll need to locate your VPN connections .pbk file. You can find it here: C:\Users\{WindowsLogin}\AppData\Roaming\Microsoft\Network\Connections\Pbk Or if you have it set ...


4

In IIS (website props): Uncheck "Anonymous access" check "Integrated Windows authentication" and "Basic authentication" Make sure that in web.config you have: <identity impersonate="true"/> <authentication mode="Windows" /> The default is set to: <authentication mode="None" /> If "Someone calls webservice" is not on the ...


4

If the login is tied to the domain account, it should be fine because at the basic level it depends on the SID of the user and not the actual username. If the new username doesn't work, you may have to reset the token cache with this command: DBCC FREESYSTEMCACHE('USERSTORE_TOKENPERM');


4

The Windows Local Security Authority (LSA) caches SecurityIdentifiers (SIDs). These cached values will retain the old username. More information: The LsaLookupSids function may return the old user name instead of the new user name if the user name has changed on a domain controller http://support.microsoft.com/kb/946358


4

This article explains it well They are two different things. The Local System Account should contain the token for NT Authority\System, so that doesn't explain why you're having issues, but there are certainly differences between the accounts. They are not synonymous for each other. This caveat could explain what you're seeing: A service that runs in ...


4

Here are a few links from Microsoft that show the data you are requesting. Note that the dynamic ranges for 2003 and 2008 have changed so if you have a mixed environment you might need to open both ranges or make them static. http://support.microsoft.com/kb/179442 http://support.microsoft.com/kb/224196 will let you limit the dynamic range to help with ...


4

No, mixed mode does not require both, obviously - it requires either one. Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have? Create a new Login for DOMAIN\cnorton and map the user to some databases. CREATE ...


4

Did you also look at the following setting for Firefox? http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/ Navigate to about:config Search for network.automatic-ntlm-auth.trusted-uris Add your URIs. Separate multiple entries with commas.


4

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


3

We had typo'd HTTP/srvarr and HTTP/srvweb as http://srvarr and http://srvweb. Make sure you do it as the protocol instead of the url! Also settings that might help others: Remove both NTLM and Negotiate and add Negotiate:Kerberos and turn on UseAppPoolCredentials and off useKernelMode Make sure all of the servers are using your domain web service account ...


3

You've understood the process correctly. You need to set up two user accounts. One would be created on the SQL Server host, the other one would be created on the client you want to connect from. Their usernames and passwords should be identical. SQL Server prefixes the username with hostname or domain name, however that is not a problem, Windows ...


3

This is more a programming question than a ServerFault one. That being said, Microsoft's documentation on LdapAuthentcation should get you started. It's pretty simple.


3

When a Windows machine joins an AD domain, a computer account is created in AD. Similar to a user account, this account has a password, although its managed by the computer, so you wouldn't normally even be aware of it, unless you had knowledge of the inner workings of AD. What happens in your case is something like this: You take a snapshot of your VM on ...


3

PhoneFactor might do the trick: http://www.phonefactor.com/solutions/terminal-services-authentication


3

It sounds like you need to use the "Active Directory Sites and Services" snap-in to define the subnets, physical locations (known as "Sites") with well-connected subnets, and connections between sites (known as "Site Links") that make up the physical network underlying your Active Directory (AD) so that your domain controllers can make good replication ...


3

SQL Server is an application. Windows Authentication and SQL authentication are two different methods for authenticating to SQL Server as an application. Both types require a user principal to be defined/created with some level of access. That's what a login is. You can create a login of either type but you must create the login and grant it some level of ...


3

Not sure of your environment setup, but this can be handled with Group Policies. Chrome and Chromium both support the AuthServerWhitelist from GPO. More information and a template for Chrome GPO's can be found here: http://www.chromium.org/administrators/policy-list-3


3

--- This is a really high level summary over-view, don't expect anything technical here --- Let's get started: What is this sharing of username and password called? "By Design"... or more specifically, "pass-through authentication". How come identical name and authentication between two windows PCs on same network works? Because this is ...



Only top voted, non community-wiki answers of a minimum length are eligible