Yet another: The account is not authorized to log in from this station

[Max]

Hi,

My set-up is as follows:

W2K Server: Domain Controller
W2K Workstations (OK, no problems)
XP Workstations (OK, no problems)
Win 98SE (OK, no problems)

I can access the fileshares in the server from all workstations and also fileshares in W2K and XP workstations
from the server. But I cannot access fileshares in Win98SE from the Server. The error reads:

"The account is not authorized to log in from this station"

This is my policy setup:

Windows 2000 Server DC

Domain Controller Security Policy

Digitally sign client communication (always) Not defined
Digitally sign client communication (when possible) Not defined
Digitally sign Server communication (always) Not defined
Digitally sign server communication (when possible) Enabled

Domain Security Policy

Digitally sign client communication (always) Not defined
Digitally sign client communication (when possible) Not defined
Digitally sign Server communication (always) Not defined
Digitally sign server communication (when possible) Enabled


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\enablesecuritysignature = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\requiresecuritysignature = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\enablesecuritysignature = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\requiresecuritysignature = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\enableplaintextpassword = 0

Windows 98SE - configured as per http://support.microsoft.com/kb/887429

Configuring SMB signing in Windows 98

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxD\VNetsup
Add the following two registry values to this registry subkey:

Value Name: EnableSecuritySignature
Data Type: REG_DWORD
Data: 0 (disable), 1 (enable)

Note The default value in Windows 98 is 1 (enable). <---

Value Name: RequireSecuritySignature
Data Type: REG_DWORD
Data: 0 (disable), 1 (enable)

Note The default value in Windows 98 is 0 (disabled). <---


What am I doing wrong?

Tx!
Tim

 

[joshua]

Hi
I think you need to change the Level of LM authentication on the domain
controller
Please check http://support.microsoft.com/kb/823659 (Point # 10)

I would recommend you to bring down LM authentication level Down one
step at a time and see what works.
I think it should work at level 3 (Send NTLMv2 response only)

Regards
Joshua Mally