15

Try this: change: <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" /> to <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" /> With the response mode 'File' IIS just loads the content of that file ...


12

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPNs. Is your domain's FQDN us.mycompany.local? In Active Directory, each user has two UPN's: Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN ...


11

I was trying to do the same thing. Access a web site on the local IIS using a FQDN and kept getting told where to go by IIS. Anyways, from my digging, you have to disable the loopback check for local IIS websites. See the following Microsoft support page. In the event the page goes missing, the I did the following (which is what he recommends in the ...


11

This really piqued my interest. I was able to replicate your findings in my lab with the same pattern of results that you describe. I used Procmon to to try to see what changes are made and almost gave up until I saw the following: That shows lsass.exe (Local Security Authority) writing to the local SAM and making a change(s) to the built-in Guest account (...


11

Have a look at vaultcmd.exe: There are my credential vaults on the file system. But I am not sure whether it's supported to just delete the vault from the file system, or if it'll leave the user's credential vault in a broken state. Also have a look at vaultcmd /deletecreds: vaultcmd /deletecreds:"Web Credentials" /credtype:{3CCD5499-87A8-4B10-A215-...


10

Use double quotes instead of single quotes: C:\>mkdir foo C:\>icacls 'C:/foo' /grant:r 'Users':f 'Users': No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files C:\>icacls "C:/foo" /grant:r "Users":f processed file: C:/foo Successfully processed 1 files; Failed processing 0 files I ...


9

I was also having this same issue and found the solution here: http://social.technet.microsoft.com/forums/en-US/itprovistanetworking/thread/275599f0-6239-46a5-8245-50a5c13a2713/ You'll need to locate your VPN connections .pbk file. You can find it here: C:\Users\{WindowsLogin}\AppData\Roaming\Microsoft\Network\Connections\Pbk Or if you have it set to ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


7

Two examples: Constrained delegation enables impersonation without having the user's credentials or authentication token. For an example, see this answer. In a more typical meat-and-potatoes unconstrained delegation scenario, whether it is windows integrated authentication or forms authentication, having delegation access to a user's authentication ...


7

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


6

To be able to use saved credentials in this situation you need to do the following: Open Group Policy Editor via cmd -> gpedit.msc Navigate to Local Computer Policy\Computer Configuration\Administrative Templates\System\Credentials Delegation\ Open Setting Allow Delegating Saved Credentials with NTLM-only Server Authentication, set it to ...


5

You probably haven't configured WMI and DCOM for remoting on your client and server. John Howard wrote a series of blog articles explaining how to connect to a non-AD integrated hyper-V server remotely and several of these steps apply to doing the same in hyper-V as well. The simplest way to do that is to download the Hyper-V remote management configuration ...


5

You've understood the process correctly. You need to set up two user accounts. One would be created on the SQL Server host, the other one would be created on the client you want to connect from. Their usernames and passwords should be identical. SQL Server prefixes the username with hostname or domain name, however that is not a problem, Windows ...


5

The problem is that your computer is not a domain member, so domain users have no permissions or access to your computer. The solution, of course, is to join your computer to the domain so that domain users (like your domain user) actually have permissions.


5

On Windows 10: In Credential Manager, within the Windows Credentials section, try deleting the credentials from the Windows Credentials sub-section and instead re-creating them in the Generic Credentials section.


5

When you logged onto the workstation with the local user account you did NOT log into the domain. Your workstation is joined to the domain but your local user is NOT logged into the domain. If you want to log into the domain then you need to create a user account in the domain. You then need to log into the domain from your workstation with the domain user ...


4

No, mixed mode does not require both, obviously - it requires either one. Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have? Create a new Login for DOMAIN\cnorton and map the user to some databases. CREATE ...


4

This is due to a security feature known as LoopbackCheck. Error message when you try to access a server locally by using its FQDN or its CNAME alias after you install Windows Server 2003 Service Pack 1: "Access denied" or "No network provider accepted the given network path" http://support.microsoft.com/kb/926642 There are two resolutions: Method 1 (...


4

Not sure of your environment setup, but this can be handled with Group Policies. Chrome and Chromium both support the AuthServerWhitelist from GPO. More information and a template for Chrome GPO's can be found here: http://www.chromium.org/administrators/policy-list-3


4

--- This is a really high level summary over-view, don't expect anything technical here --- Let's get started: What is this sharing of username and password called? "By Design"... or more specifically, "pass-through authentication". How come identical name and authentication between two windows PCs on same network works? Because this is what it's ...


4

This article explains it well They are two different things. The Local System Account should contain the token for NT Authority\System, so that doesn't explain why you're having issues, but there are certainly differences between the accounts. They are not synonymous for each other. This caveat could explain what you're seeing: A service that runs in ...


4

You may want to confirm if the security connection is NTLM or Kerberos. If it is reverting to NTLM, the connection will be anonymous. There is a group policy that enables using the computer identity when NTLM is used. Network security: Allow Local System to use computer identity for NTLM http://technet.microsoft.com/en-us/library/jj852275%28v=ws.10%29....


4

Here are a few links from Microsoft that show the data you are requesting. Note that the dynamic ranges for 2003 and 2008 have changed so if you have a mixed environment you might need to open both ranges or make them static. http://support.microsoft.com/kb/179442 http://support.microsoft.com/kb/224196 will let you limit the dynamic range to help with ...


4

This are the most common causes: username and password is correct BUT contains national characters like łóżźęą or other special things. I observed sometimes this fails. In other words try a completely different password. username is more than 20 chars. double check User properties what is the pre-win2000 login. username and password is correct ...


4

Solution Wouldn't you know it, about a month after we had abandoned this approach to using a RADIUS server to control access to the SBC we find a possible solution. Of course at this point we are too busy with other projects to go back and try this solution out so I can't say 100% if this would fix the problem but once I explain you will probably agree this ...


4

If anyone else encounters this like I did so starting from 9.5 you will need to add an optional parameter both to the ipv4 and ipv6 in order for this to work include_realm=0 so the whole thing will look like host all your_username 127.0.0.1/32 sspi include_realm=0


4

Updating the registry key below on the server running IIS fixed the issue! In Registry Editor, locate and then click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 Right-click MSV1_0, point to New, and then click Multi-String Value. Type BackConnectionHostNames, and then press ENTER. Right-click ...


4

The key difference is that a Security Identifier (SID) is immutable, whereas both SAM Account Name (CONTOSO\USERNAME) and User Principal Name (UPN, username@contoso.com) can be changed. In a Windows Active Directory domain a user might have permissions to resources across many servers and workstations. If all those permissions were bound to usernames, ...


3

First, I would confirm that this is occurring from a client where IE shows that the site is in the Trusted Sites zone, and the Trusted Sites zone is configured for "Automatic logon with current username and password." Next, I would suspect the http authorization header size may exceed the IIS limits. Integrated Kerberos authorization is quite susceptible ...


3

You still need to create a login in SQL server for the AD user 'cnorton', but you do not need to create a password for him. In SSMS, select the server instance you need, and then under logins, right click and hit "New login..." In the dialog you can press the search button, and search your AD instance for names: You can see in this case I've selected a ...


Only top voted, non community-wiki answers of a minimum length are eligible