Hot answers tagged

11

This really piqued my interest. I was able to replicate your findings in my lab with the same pattern of results that you describe. I used Procmon to to try to see what changes are made and almost gave up until I saw the following: That shows lsass.exe (Local Security Authority) writing to the local SAM and making a change(s) to the built-in Guest account ...


8

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPN's. Is your domain's FQDN us.mycompany.local? In Active Directory, each user has two UPN's: Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN ...


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


8

Have a look at vaultcmd.exe: There are my credential vaults on the file system. But I am not sure whether it's supported to just delete the vault from the file system, or if it'll leave the user's credential vault in a broken state. Also have a look at vaultcmd /deletecreds: vaultcmd /deletecreds:"Web Credentials" ...


7

Try this: change: <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" /> to <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" /> With the response mode 'File' IIS just loads the content of that file ...


7

Did about an hour searching on the internet before I asked this question. But after asking it I did just another search giving the answer :-), matter of finding the correct keywords. Here the answer: http://stackoverflow.com/questions/5724377/mvc3-site-using-azure-acs-adfs-continually-prompts-for-credentials-when-using


6

From Microsoft KB 243330 Well-known security identifiers in Windows operating systems SID: S-1-5-32-545 Name: Users Description: A built-in group. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the ...


6

Two examples: Constrained delegation enables impersonation without having the user's credentials or authentication token. For an example, see this answer. In a more typical meat-and-potatoes unconstrained delegation scenario, whether it is windows integrated authentication or forms authentication, having delegation access to a user's authentication ...


6

Use double quotes instead of single quotes: C:\>mkdir foo C:\>icacls 'C:/foo' /grant:r 'Users':f 'Users': No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files C:\>icacls "C:/foo" /grant:r "Users":f processed file: C:/foo Successfully processed 1 files; Failed processing 0 files I ...


6

I was also having this same issue and found the solution here: http://social.technet.microsoft.com/forums/en-US/itprovistanetworking/thread/275599f0-6239-46a5-8245-50a5c13a2713/ You'll need to locate your VPN connections .pbk file. You can find it here: C:\Users\{WindowsLogin}\AppData\Roaming\Microsoft\Network\Connections\Pbk Or if you have it set ...


6

The problem is that your computer is not a domain member, so domain users have no permissions or access to your computer. The solution, of course, is to join your computer to the domain so that domain users (like your domain user) actually have permissions.


5

You probably haven't configured WMI and DCOM for remoting on your client and server. John Howard wrote a series of blog articles explaining how to connect to a non-AD integrated hyper-V server remotely and several of these steps apply to doing the same in hyper-V as well. The simplest way to do that is to download the Hyper-V remote management configuration ...


5

Did you set the policy for warning them of password expiration? Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Interactive logon: Prompt user to change password before expiration Here set the number of days (default is 14) before users start getting warnings that their password will expire... I ...


4

Did you also look at the following setting for Firefox? http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/ Navigate to about:config Search for network.automatic-ntlm-auth.trusted-uris Add your URIs. Separate multiple entries with commas.


4

Here are a few links from Microsoft that show the data you are requesting. Note that the dynamic ranges for 2003 and 2008 have changed so if you have a mixed environment you might need to open both ranges or make them static. http://support.microsoft.com/kb/179442 http://support.microsoft.com/kb/224196 will let you limit the dynamic range to help with ...


4

This article explains it well They are two different things. The Local System Account should contain the token for NT Authority\System, so that doesn't explain why you're having issues, but there are certainly differences between the accounts. They are not synonymous for each other. This caveat could explain what you're seeing: A service that runs in ...


4

No, mixed mode does not require both, obviously - it requires either one. Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have? Create a new Login for DOMAIN\cnorton and map the user to some databases. CREATE ...


4

In IIS (website props): Uncheck "Anonymous access" check "Integrated Windows authentication" and "Basic authentication" Make sure that in web.config you have: <identity impersonate="true"/> <authentication mode="Windows" /> The default is set to: <authentication mode="None" /> If "Someone calls webservice" is not on the ...


4

If the login is tied to the domain account, it should be fine because at the basic level it depends on the SID of the user and not the actual username. If the new username doesn't work, you may have to reset the token cache with this command: DBCC FREESYSTEMCACHE('USERSTORE_TOKENPERM');


4

The Windows Local Security Authority (LSA) caches SecurityIdentifiers (SIDs). These cached values will retain the old username. More information: The LsaLookupSids function may return the old user name instead of the new user name if the user name has changed on a domain controller http://support.microsoft.com/kb/946358


4

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


3

We had typo'd HTTP/srvarr and HTTP/srvweb as http://srvarr and http://srvweb. Make sure you do it as the protocol instead of the url! Also settings that might help others: Remove both NTLM and Negotiate and add Negotiate:Kerberos and turn on UseAppPoolCredentials and off useKernelMode Make sure all of the servers are using your domain web service account ...


3

You've understood the process correctly. You need to set up two user accounts. One would be created on the SQL Server host, the other one would be created on the client you want to connect from. Their usernames and passwords should be identical. SQL Server prefixes the username with hostname or domain name, however that is not a problem, Windows ...


3

This is more a programming question than a ServerFault one. That being said, Microsoft's documentation on LdapAuthentcation should get you started. It's pretty simple.


3

By default anonymous users use IUSR account when connecting to the site. You can change this user to a different user (who might have different privileges) and all anonymous users will use that account when connecting to the site, instead of the default IUSR account. From MSDN on when to specify a different user for Anonymous Authentication If your ...


3

Try adding the new site URL to the trusted sites list in IE and give it another shot.


3

From what you mentioned, it seems there are two machines: A. Your home server with SQL 2008 R2. B. Your laptop with SQL Management Studio. Points to remember: What edition of SQL 2008 R2 did you install on the home server? Is it full version (STD/ENTERPRISE) or express? If it is full version, then by default, the default instance is installed. Else ...


3

You will need to log onto the SQL server with the SA account (SQL authentication) and remove the SERVERNAME\Administrator account and re-add it back. When you promoted the machine to a DC, and then demoted it, your Administrator account SID would have been reset. So the SID the SQL server has to identify the administrator is not valid anymore.


3

I had a similar situation with a client. The domain controllers were misconfigured (in NT4 mode), and IE had the "Enable Windows Integrated Security" option checked. What IE does when in Windows Integrated Security mode is it tries the request with a Windows 2000+ mode AD/Kerberos ticket. When the web server fails to authenticate the ticket, it fails back ...



Only top voted, non community-wiki answers of a minimum length are eligible