|
Posted by Peter Foldes on May 22, 2009, 4:59 pm
If you were Registered and logged in, you could reply and use other advanced thread options
You will be better off by posting this to a Server related Security newsgroup
On the web:
http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.server.security
--
Peter
Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
>I turned on Kerberos logging on the Terminal Server. When the user logs into
> the Terminal Server using kerberos, the logon process attempts to load their
> profile and redirect their profiles using kerberos. This is failing because
> we don't have SPNs registered for these resources. I'm guessing the logon
> process then attempts NTLM and that is failing because they didn't login with
> NTLM.
>
> Is there any way to get the fallback to NTLM to function? If not, how does
> one go about registering SPNs for file-shares that are cluster resources
> (virtual IPs and computer names that aren't regisered in Active Directory).
> In addition, how does one go about registering SPNs for DFS roots?
>
> Any/all help is appreciated.
>
> Thanks.
>
> "McDavid" wrote:
>
>> Environment:
>> - Windows 2008 x64 Server Standard
>> - Kerberos Token Size set to maximum
>>
>> Issue:
>> When our users logon to our Terminal Servers using kerberos, they receive a
>> temporary profile and none of the Folder Redirection policies are applied.
>> The event log reports both processing failing with "Logon failure: unknown
>> user name or bad password.". However the user is successfully logged onto
>> the server using kerberos. The server hosting the profiles also reports
>> "unknown user name or bad password" in the security log and the
>> authentication package as NTLM. The users can navigate to the network
>> locations of their roaming profiles and redirected folders just fine without
>> any errors.
>>
>> If the users logon to our Terminal Servers using NTLM, their roaming profile
>> is loaded and folder redirection policies applied successfully.
>>
>> Kerberos is the required authentication method for logging into our Terminal
>> Servers. We are using Citrix Web Interface and single signon leverages
>> kerberos.
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML site map