G
Guest
Hello,
We have 5 domains, all in the same forest, two of the children domains have
an authentication issue. The strange thing, is, only in some cases. If a
DOM1 user tries to log on interactively to a machine in DOM2, it will act
like the password is incorrect, even though it is perfectly correct. In
addition, this phenomenon only happens in a single site. The reverse (DOM2
user logging onto DOM1 machine) has no problem. I know this is a hard
question due to the complexity of the architecture, but what I'm really
wondering is, why does it only fail in certain methods, like interactive
logon, but it works when one defines a service with credentials (on the same
machine, no less). What could be causing the difference, and why does the
error message act like the password is wrong, rather than give a more
accurate error message?
We have no policies denying logon locally with servers mentioned. I checked
the security logs of DOM1's domain controllers, and purposefully put in an
incorrect password, which was logged, and all the supposed "incorrect"
passwords, were not logged as incorrect on my domain controllers. There is
a slightly different syntax on the error when given from the RunAs method,
in this case, it simply says "unknown username or bad password." which is
how it appears in the DOM2 member server's security logs. Again, if one
defines a service on the DOM2 server, to log on as the DOM1 user, it has no
problems, and this is the same server. What gives?
Below are the logon methods used.
Login Successful
---------------
Remotely Anywhere
Running a Service with credentials
Login Unsuccessful
We have 5 domains, all in the same forest, two of the children domains have
an authentication issue. The strange thing, is, only in some cases. If a
DOM1 user tries to log on interactively to a machine in DOM2, it will act
like the password is incorrect, even though it is perfectly correct. In
addition, this phenomenon only happens in a single site. The reverse (DOM2
user logging onto DOM1 machine) has no problem. I know this is a hard
question due to the complexity of the architecture, but what I'm really
wondering is, why does it only fail in certain methods, like interactive
logon, but it works when one defines a service with credentials (on the same
machine, no less). What could be causing the difference, and why does the
error message act like the password is wrong, rather than give a more
accurate error message?
We have no policies denying logon locally with servers mentioned. I checked
the security logs of DOM1's domain controllers, and purposefully put in an
incorrect password, which was logged, and all the supposed "incorrect"
passwords, were not logged as incorrect on my domain controllers. There is
a slightly different syntax on the error when given from the RunAs method,
in this case, it simply says "unknown username or bad password." which is
how it appears in the DOM2 member server's security logs. Again, if one
defines a service on the DOM2 server, to log on as the DOM1 user, it has no
problems, and this is the same server. What gives?
Below are the logon methods used.
Login Successful
---------------
Remotely Anywhere
Running a Service with credentials
Login Unsuccessful