0

Having a weird issue. I have a remote user that is using a non-domain computer. He has an domain user account at na.contoso.com. When he connects to the vpn and tries to authenticate to gain access to a share file in na.contoso.com, he is able to do it successfully. When he tries to gain access to a share file in la.contoso.com, he receives an error that his login failed, uknown user and password. The two domains have an active trust between them and if this user is using a domain computer at na.contoso.com, he is able to access shared files at la.contoso.com without any issue.

While on the non domain computer, ive tried using the server at la.contoso.com with its full FQDN and ip address while using the users domain credentials as domain\username and username@domain.com but it does not work. Any reason why this isnt working that you guys can think of? Thanks in advance.

Improve this question
  • Have you tried username@na.contoso.com for the user name? – Nixphoe Dec 2 '16 at 16:18
  • yes. When trying to access shares on na.contoso.com, it works fine. When trying to access shares on la.contoso.com, it failes with the message login failed, unknown username or password. – user247326 Dec 2 '16 at 16:36
0

I think credentials against SMB shares are not stored at the same level as credentials against user account in domain. When user authenticates the LOGIN PROFILE against domain, kerberos keys are issued for any user activity during the logon session. But when user authenticates against SMB share, kerberos keys are not created for the whole user session, but only against authenticating SMB share server.

I am not 100% sure about my description, as it was quite some years ago when we were talking about the exact same problem. But roughly, it is it.

So, what to do? Establish VPN connection, mark it to allow to be used by any user (last tab under properties of VPN connection on client), and join computer to domain. Maybe sometimes it won't be able to authenticate due to failed VPN connectivity, but stored logins are valid for 6 months and that's the time frame it needs to authenticate at least once to prolong domain login cache for next 6 months. That way USER session will be authenticated as whole and domain trust will come in play.

Improve this answer
-1

try to delete all VPN connection. cleaned all cookies, files, etc. restart the computer and then try to create again. once I managed to solve this problem this way

Improve this answer
  • I am not sure a restart would necessarily help with this kind of authentication issue - did you find any other ways to fix your issue? – iwaseatenbyagrue Mar 7 '17 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.