We are having a problem where one user is unable to authenticate using Windows Authentication. The site is configured to allow "All Users" to access the website and I have confirmed that this user is a member of the "Domain Users" group in AD.

Looking at this users group membership side by side another user, they are identical. However if I copy the user and test with the new account, it also can't use the windows auth.

Any help at all in figuring out why just this one user can't authenticate would be greatly appreciated.

I apologize if I left any important details out; I'm a developer and I don't know much about server administration or networking. The biggest problem is that I don't know the right question to ask to debug this thing I'm sure.

Update, from the server log on this failure:

Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a

I am 100% certain the username/password are correct.

  • What is the domain and username you're having trouble with? – Dave Lucre Feb 4 '14 at 20:51
  • amerifirst\pmaniccia and the cloned version of this account: amerifirst\btest – Chronos Feb 4 '14 at 20:54
  • Have you tried using the full address at all? i.e. pmaniccia@amerifirst.whateverelse.goeshere – Dave Lucre Feb 4 '14 at 20:57
  • I have, no luck there. – Chronos Feb 4 '14 at 20:58
  • You're using Windows Authentication, which means you'll also be using NTFS permissions on the web application. Double check that the NTFS permissions on the web app's directory permits this user, or their group, to read the directory. Even though the site allows All Users, doesn't mean that the NTFS permissions on the directory the site's running from does. – Dave Lucre Feb 4 '14 at 20:59

This are the most common causes:

  • username and password is correct BUT contains national characters like łóżźęą or other special things. I observed sometimes this fails. In other words try a completely different password.
  • username is more than 20 chars. double check User properties what is the pre-win2000 login.
  • username and password is correct however the account has expired. Check appropriate properties tab in AD. Account may look like active but it is not. It is NOT disabled. Just expired.
  • type password in the username field to be 100% sure You are typing what You think You are typing (wrong keyboard settings !)
  • account locked due to incorrect login attempts. Depending on policy it may not unlock itself. double check if it is not locked.
  • reset the password from each AD controller and check if it helps. Sometimes for some unknown to me reasons a password was not replicated across AD and just resetting it helps from a different AD controller.
  • check DisableLoopbackCheck key workaround - sometimes it helps: http://support.microsoft.com/kb/896861
  • Thanks. None of these fixed this issue but this is good info. – Chronos Feb 4 '14 at 23:09
  • This helped me, here but let to me fixing my authentication problem. It was because I use a Mac and RDP to connect to our DC and I reset a pw that contained the @ symbol in it which is in a different location on Mac/PC keyboards. E.g. if I typed p@ssword it was in fact being set to p"ssword – Robin Sep 21 '17 at 10:21

We have had issues like this before where it works with another user but if we copy the bad user for a test account it doesnt work. The end result is creating a new user for that person. Just make sure you copy a user that is working and create his username differently than his original.

ex. Name- james smith Windows login - jsmith

New Windows login - jasmith

Hope that helps, its not a fix but its a great work around

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.