2

I have enabled Point-to-Site connectivity to a virtual network in my Azure environment. I am able to remotely connect to the VPN tunnel and can ping the private address of the Azure virtual machine. I can also RDP into the server. The problem is that I am not able to access file shares. On this virtual network we also have a site-to-site vpn up so that the office can access the server. The site-to-site is working fine. The users can access the shared folders, query DNS, and authenticate against AD. Does anyone have any idea why ICMP and RDP would work over the point-to-site VPN but file share browsing would not? I have confirmed that DNS is resolving correctly.

Improve this question

5 Answers 5

Reset to default
1

I tested it in my lab and I encountered same issue with you.

Here are the steps how I solve this issue.

First, I perform a network capture on the Server side.

Capture

I find that it is the server which wants to disconnect the session. And the error code is "STATUS_MORE_PROCESSING_REQUIRED", which means that additional authentication information is to be exchanged.

I suspect that the client is using the credential of the VPN to access the shared folder on server. So I create a VPN profile manually and set the UseRasCredentials to 0. The path of the PBK file is "%userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk".

Then my client is able to access the file share.

If it isn't your situation, you are also able to start troubleshooting by performing a network capture first.

=======================================================================

Update

To manually create a VPN profile, we need to find the host name of Azure network gateway. The host name is logged in the rasphone.pbk mentioned above. Note: we need to install the profile downloaded from the Azure first, so the configuration will be written to the rasphone.pbk.

Then, we just need to create a SSTP VPN profile with this hostname. The authentication method is "Microsoft:Smart Card or other certificate ---> Use a certificate on this computer".

Improve this answer
3
  • Can you give me some instruction on how to create the Azure VPN profile manually?
    – 360VisionIT
    Aug 31, 2016 at 13:06
  • @360VisionIT I'll update my answer later to make a better explanation.
    – Steven Lee - MSFT
    Sep 1, 2016 at 1:44
  • Thank you. All I did was change the UseRasCredentials from a 1 to a 0 in the rasphone.pbk file. It works like a champ now.
    – 360VisionIT
    Sep 3, 2016 at 3:04
1

The following key did the trick for me [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"disabledomaincreds"=dword:00000001

Improve this answer
1
  • Could you explain how this solves the problem described, as well as any downsides (such as security issues) that this solution may have?
    – womble ♦
    Nov 17, 2019 at 23:49
0

At remote host, You need to map the network drive in Windows Explorer and choose "Connect using different credentials". After this, type the credentials of user in server.

It works fine for me (Over Azure VPN PS2).

Improve this answer
0

The following key did the trick for me

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"disabledomaincreds"=dword:00000001

This is the resolve because when you connect with a Certificate you are not taking an identity on the VPN as you would if you used the AzureAD logon.

After setting this the connection to a resource after vpn connects will prompt for creds so you can say who you are.

**** This is not good in the case of security and troubleshooting. All users can have cert and you will not know exactly who is having issues or if cert was shared. Anyone with certs installed can connect.

Improve this answer
0

  1. Look in %userprofile%\Local\Packages\ for Microsoft.AzureVpn_XXXXXXXXX\

  2. In there edit LocalState\rasphone.pbk

  3. Change UseRasCredentials to =0

  4. Reboot.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .