3

I've got a Windows Server 2008 R2 SP1 Active Directory with Full 2008 R2 Level Domain and a Windows XP SP3 Client which needs to join this domain.

Unfortunately the client is not able to join the domain and if I take a look at the Server's logs I saw the following error:

EVENT ID: 4776 error N° 0xc000006a

Following my search on Google, I've reset all my GPO's with the dcgpofix command according to the MS knowledge base, but once again my Windows client is still unable to join the domain and thrown up the same error.

Ok, so, I've made some progress with this issue.

I've notice two things:

First of all: - It seems to be a Kerberos Issue, because every logs are talking about Kerberos.

From server:

EVENT ID: 4776 error N° 0xc000006a

This mean, correct username, bad password (I'm sure of the password 'cause I'm using it to log me in the DC). And the first FAIL on my list is:

EVENT ID: 4768 -> A Kerberos Ticket has been requested.

Secondly:

On the client side I've a single error:

EVENT ID: 4 -> Error Kerberos, Source: Kerberos -> The client received a KRB_AP_ERR_MODIFIED error from the server prdldap01$. This indicates that the password used to encrypt the kerberos ticket is different than that on the target server.

Then, I've try to check the ticket on the client with the Klist tickets command, BUT there is no one on the client.

The klist command report:

Cached tickets: (0)

Finally:

All my Windows 7 clients are correctly joining the domain. My Server send the following ticket encryption:

KerbTicket Encryption: AES-256-CTS-HMAC-SHA1-96

My LSA Notification packages are the followings

SCECLI RASSFM SHA1HEXFLTR

My LSA Security packages are the following:

kerberos msv1_0 schannel wdigest tspkg pku2u

I really start to suspect the Domain Security GPO or Kerberos settings. If anyone have an idea, I'm listening :D

Improve this question

3 Answers 3

Reset to default
4

Your error is related to miscommunication between the client and the DC. Make sure that there are no kind of packet filtering in place between - even disable the built in firewall to make sure.

Also - check that time/date is aligned between them, silly yes but it's reason #1 for AD problems.

Improve this answer
1
  • Thanks for your answer. My Windows XP and Windows 2008 are on the same lan into a VMWare Cluster without any filtering between the elements. About the timesync, my kerberos default settings allow a difference of 5 minutes which, obviously, is not the case. All my servers and clients are sync with the ESX Host. Oh, and my Windows 7 clients join the domain perfectly, I suspect a problem of Ciphering between the clients and the server but, even if I set the Domain to accept old ciphers it's not working.
    – Dr I
    Dec 12, 2011 at 14:40
1

Well, I finally find out what's going on with my domain. the problem came from a Google's authentication module added to bind our AD to Google's infrastructures.

This module is quite usefull, but very buggy and insecure, so, if anyone of you use the SHA1HEXFilter module from Google, be advise of some password hash leak over your network.

Thanks to all who try to troubleshoot my issue :D

Improve this answer
2
  • i'm not sure to understand your answer? the google module is on the client or on the server?
    – user118593
    Apr 24, 2012 at 15:55
  • In fact the problem came from the Google plugin on the server side. Unfortunatly, it affect only windows under Vista version because of the lack of ciphers handling.
    – Dr I
    Apr 24, 2012 at 22:05
1

In case this was a Kerberos encryption-type problem: The Kerberos implementation in Windows XP SP3 did not support the newer encryption types AES128-CTS-HMAC-SHA1-96 and AES256-CTS-HMAC-SHA1-96. These were added only in Windows Vista. The fix has long been to phase out Windows XP. Previously, the solution was to make sure the boxes “This account supports AES 128/256-bit encryption” in the Active Directory Users and Computers GUI under the “Account” tab are unticked for any pre-Vista users and computers involved.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .