4

I've been stuck on this for a while, not sure what permission I'm missing. I've got domain A and domain B, A trusts B, but B does not trust A. I'm trying to run a service in domain A with a user account from domain B and I keep getting Access is Denied. I'm using the FQDN after the username and the password is correct. The user account from domain B is a local administrator on the domain A server, the user account has the logon locally, and as a service permissions. Must. Get. This. Working.

enter image description here

Update:

I found something interesting in the logs I must have missed. This ought to get me pointed in the right direction. Event ID: 40961 - LsaSrv : The Security System could not establish a secured connection with the server ldap/{server fqdn/fqdn@fqdn} No authentication protocol was available.

I've found a few fixes for 40961 but nothing has worked so far. I've verified reverse lookup zones. nslookup resolves the correct dc properly. still workin' at it.

Upadte:

In response to Evan;

I ran " runas /env /user:ftp_user@fqdn "notepad" " then entered the users password and notepad came up. It seems to work successfully.

Improve this question
8
  • 2
    Check what the failure event in the security log looks like?
    – Shane Madden
    Oct 26, 2012 at 18:34
  • 1
    Just a random guess, but perhaps the Access is Denied has nothing to do with the username you're using, but rather that you don't have permission to modify that service. Can you change anything else in there (like the startup type?)
    – Mark Henderson
    Oct 26, 2012 at 19:12
  • I'm new to ServerFault, so I'm not sure if I'm responding in the right place, sorry about that. I found something interesting in the logs I must have missed. This ought to get me pointed in the right direction. Event ID: 40961 - LsaSrv : The Security System could not establish a secured connection with the server ldap/{server fqdn/fqdn@fqdn} No authentication protocol was available.
    – EWood
    Oct 26, 2012 at 19:29
  • @EWood You should edit your question when adding information so that the question is always complete. You can then add a comment addressing whoever asked for the information so that they get notified.
    – mgorven
    Oct 26, 2012 at 22:56
  • What happens when you try to do a "RUNAS /user:P_User@prod... cmd" on that machine?
    – Evan Anderson
    Oct 26, 2012 at 23:29

1 Answer 1

Reset to default
2

This issue is now resolved. The problem is visible in the screenshot. Windows tries to use the UPN for the user account if you dig your user out of AD with the Browse button. This fails every time even with the right user and password. Simply using the SAM format (Domain\User) works. So simple, yet so annoying. Can't believe I missed this.

Thanks to everyone who helped.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .