0

Im seeing some oddities relating to either authentication events or the logs themselves. My question is do the authentication events or the logs replicate across domain controllers?

Im seeing the same failed login attempt from two different domain controllers (the login attempts are being made by me as part of a test).

Im am attempting to login directly to the smb service on a windows 2003 controller (yes I am well aware its out of date) I am seeing the same event on a 2008 controller.

Any guidance would be appreciated.

2

It sounds like it's working as expected. When authentication fails at a domain controller other than the PDC emulator, the authentication is retried at the PDC emulator. That would explain the behavior you're seeing. I'm assuming that one of the two DC's in question is the PDCe. See the additional information under the Urgent Replication of Account Lockout Changes section of this article:

https://technet.microsoft.com/en-us/library/cc961787.aspx

  • ok so even though Im making an authentication request directly to a specific DC via an SMB call. The authentication would happen on both the target DC and the PDCe? – LearningCode Mar 2 '16 at 16:41
  • 1
    If the authentication fails then it is retried against the PDCe. It's not a simultaneous event. – joeqwerty Mar 2 '16 at 16:51
  • Great makes perfect sense – LearningCode Mar 2 '16 at 16:51
-1

No, event logs do not replicate. The Windows login process performs many actions and the device may connect to multiple domain controllers. This is based on how DNS is used to identify the domain controllers in a default configuration. Each DNS query can provide a different IP address than the previous request. Windows does things like read Active Directory object attributes, pulls down group policy object files over SMB and so on - not just the true "login". Please add more information like the actual event details if you would like a clearer answer.

  • This is not a 'Windows' login process (interactive), this is a 'Network' login type using SMB via commandline using medusa. DNS is used to resolve names, not identify a DC to authenticat too. – LearningCode Mar 2 '16 at 16:48
  • If you use Kerberos authentication, which Windows will try to do if you are using a name, then the client device first obtains (if it does not already have one) a ticket granting ticket from AD and will use DNS as part of the process identifying the DC to connect to. Then the client will obtain a ticket to the SPN (for SMB, it will be HOST/FQDN of server) and again use DNS. That ticket will then be presented to the SMB host. As you still have not disclosed the actual events, the question is still vague imo and so there is no way to clearly answer you. DNS is critical to AD authentication. – user339468 Mar 2 '16 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.