A virtual machine can't authenticate accounts from a domain

Hello,
I have a Windows Server 2012 R2 Standard server with Hyper-V, where there is a VM.  Hyper-V Manager is 6.3.9600.16384 is used.
The VM was created and at that time it was able to authenticate accounts from anther domain.  The VM is in one domain, say Domain A, and the VM and applications on the VM was able to use accounts in another domain, say Domain B.  Doman
A and Domain B had a trusted relationship and all was working great on the VM and other servers in Domain A.
Then, the trusted relationship was broken.  The applications and the VM still worked, but you could not add and use accounts in Domain B.  Applications using accounts in Domain B could be not be authenticated either.
Then, recently we fixed the broken relationship between the two domains.  However, on the VM, accounts from Domain B could not be added to applications and could not be authenticated nor used, even though other servers in Domain A had accounts
from Domain B working again.
What can be done to get the VM to recognized accounts in Domain B, now that the trusted relationship is working again between to two domains?
Paul

Hi Paul,
Please try to re-join the VM to domain A then test again .
Also you can use these methods mentioned in the following article to re-build the secure channel ：
http://blogs.technet.com/b/heyscriptingguy/archive/2012/03/02/use-powershell-to-reset-the-secure-channel-on-a-desktop.aspx
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

Similar Messages

  • How I can delete my account from Itunes Store? [I am not using it anymore and will not]]

    How I can delete my account from Itunes Store? [I am not using it anymore and will not]

    Just stop using it and remove your payment info.
    There is no need to do more.

  • My partner and I share the powerbook and I use my iPad, Though we each log in with separate accounts all my pics and music are in both libraries .   Can I isolate accounts from iCloud ?

    My partner and I share the powerbook and I use my iPad, Though we each log in with separate accounts all my pics and music are in both libraries .   Can I isolate accounts from iCloud ?

    Not quite sure exactly what you want to do, but you cannot do it on a PowerBook. iCloud requires Lion and Lion requires an Intel MacBook or MacBook Pro.

  • How can i switch account from U.S. store in Romania store?

    How can i switch account from U.S. store in Romania store?

    see here
    http://support.apple.com/kb/HT1311

  • I forgot my security questions and I just added a gift card. Is there anyway I can manage my account from my iPhone becuase I don't have a conputer?

    I forgot my security questions and I just added a gift card. Is there anyway I can manage my account from my iPhone becuase I don't have a conputer?

    Security questions:
    https://discussions.apple.com/docs/DOC-4551

  • How i can delete my account from Apple?

    How i can delete my account from Apple?

    You can't delete it; just don't use it.

  • "Account Generator" you can read budget account from item level

    Dear Values Consultant.
    I am reading from oracle purchasing user guide that if you deal with "Account Generator" you can read budget account from item level
    How I can enable this functionality "account generator to gets a budget account from Item Level)
    Or it is already defaulted enable in the application
    If it is default enable, how to use this functionality, what the setup required to reach to this point
    thanks

    It is Oracle standard functionality. Account generator can be customised as per need.
    Define your Accounting Flexfield structure for each set of books.
    Define flexfield segment values and validation rules.
    Set up Oracle Workflow.
    Choose whether you want to use the default Account Generator
    processes
    Then do one of the following for each set of books:
    Choose to use the default Account Generator processes.
    Customize the default Account Generator processes, test your
    customizations, and choose the processes for a flexfield
    structure, if necessary.

  • How can delete my account from the adobe cloud

    how can delete my account from the adobe cloud
    I would like to unregister myself from the service

    Hi mehranr34543413,
    Please Contact Customer Care. A Customer Care agent can help you with that request.
    Best,
    Sara

  • Virtual Machine Manager 2012 R2 migrate from standalone to cluster - no starting

    Hello,
    we have migrated our Virtual Machine Manager 2012 R2 UR1 installatin from a standalone machine to a clustered version.
    But now the cluster instance won't startup.
    - uninstall the standalone virtual machine manager 2012 with the retain database option.
    - created failover cluster
    - installed vmm into cluster and pointed to existing database.
    - added second node
    The error we now get is out of the report.txt:
    ------------------- Error Report -------------------
    Error report created 17.04.2014 19:38:57
    CLR is not terminating
    --------------- Bucketing Parameters ---------------
    EventType=VMM20
    P1(appName)=vmmservice.exe
    P2(appVersion)=3.2.7620.0
    P3(assemblyName)=ImgLibEngine.dll
    P4(assemblyVer)=3.2.7620.0
    P5(methodName)=Microsoft.VirtualManager.DB.Adhc.StoredCertificate.CacheVMConnectCertificate
    P6(exceptionType)=System.AggregateException
    P7(callstackHash)=7b6a
    SCVMM Version=3.2.7620.0
    SCVMM flavor=C-buddy-RTL-AMD64
    Default Assembly Version=3.2.7620.0
    Executable Name=vmmservice.exe
    Executable Version=3.2.7510.0
    Base Exception Target Site=140721289766296
    Base Exception Assembly name=mscorlib.dll
    Base Exception Method Name=System.Security.Cryptography.CryptographicException.ThrowCryptographicException
    Exception Message=One or more errors occurred.
    EIP=0x00007ffc469c43c8
    Build bit-size=64
    ------------ exceptionObject.ToString() ------------
    System.AggregateException: One or more errors occurred. ---> System.Security.Cryptography.CryptographicException: The specified network password is not correct.
    at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
    at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle& pCertCtx)
    at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
    at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, SecureString password, X509KeyStorageFlags keyStorageFlags)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.CacheVMConnectCertificate(StoredCertificate cert)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.ImportCertificates(List`1 certificates, ReportCertImportFailure ReportImportFailure)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.ImportAllCertificates(ReportCertImportFailure ReportImportFailure)
    at Microsoft.VirtualManager.Engine.VirtualManagerService.LoadCertificates()
    at Microsoft.VirtualManager.Engine.VirtualManagerService.TimeStartupMethod(String description, TimedStartupMethod methodToTime)
    at System.Threading.Tasks.Task.Execute()
    --- End of inner exception stack trace ---
    at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
    at Microsoft.VirtualManager.Engine.VirtualManagerService.WaitForStartupTasks()
    at Microsoft.VirtualManager.Engine.VirtualManagerService.TimeStartupMethod(String description, TimedStartupMethod methodToTime)
    at Microsoft.VirtualManager.Engine.VirtualManagerService.ExecuteRealEngineStartup()
    at Microsoft.VirtualManager.Engine.VirtualManagerService.TryStart(Object stateInfo)
    at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
    at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
    at System.Threading.TimerQueueTimer.CallCallback()
    at System.Threading.TimerQueueTimer.Fire()
    at System.Threading.TimerQueue.FireNextTimers()
    ---> (Inner Exception #0) System.Security.Cryptography.CryptographicException: The specified network password is not correct.
    at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
    at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle& pCertCtx)
    at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
    at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData, SecureString password, X509KeyStorageFlags keyStorageFlags)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.CacheVMConnectCertificate(StoredCertificate cert)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.ImportCertificates(List`1 certificates, ReportCertImportFailure ReportImportFailure)
    at Microsoft.VirtualManager.DB.Adhc.StoredCertificate.ImportAllCertificates(ReportCertImportFailure ReportImportFailure)
    at Microsoft.VirtualManager.Engine.VirtualManagerService.LoadCertificates()
    at Microsoft.VirtualManager.Engine.VirtualManagerService.TimeStartupMethod(String description, TimedStartupMethod methodToTime)
    at System.Threading.Tasks.Task.Execute()<---
    Maybe someone has an idea where to look at.
    Best Regards,
    Marcus
    Marcus Lehmann

    Hi,
    nope, we solved it.
    It seems that this behavior occurs only under special circumstances.
    Scenario is:
    1. RDP Gateway connection to our Hyper-V Hosts (We need it for our Windows Azure Pack installation). A certificate is needed to encrypt the connection between RDPGW and Hyper-V host. This certificate is distributed by the VMM to the Hyper-V Hosts with the
    private key.
    2. Migrating from standalone installation to High Availability therefore migrating from DPAPI to DKM
    It looks like that the key or the password to unencrypt the private key, which is stored in the database, is itself stored in the DPAI/DKM.
    So when you try to get the migrated Service online the error report in my first post is generated.
    What we did was fiddeling around in the database. Make sure you have a backup !!
    You need two tables:
    tbl_ADHC_Host
    tbl_VMM_CertificateStore
    1. Go to the table "tbl_ADHC_Host" and edit the key fk_ADHC_Host_VMM_CertificateStore and set "Enfore Foreign Key Constraint" to "No".
    2. get the value "VMConnectCertficateID" from the table "tbl_ADHC_Host"
    3. Go to the table "tbl_VMM_CertificateStore" and delete the Certficate with the value which equals the "VMConnectCertificateID". Note: Corresponding Certificate in the CErtificatestore table should have something in the column "PrivatekeyPassword"
    and an ObjectType of 6.
    4. The service should now start and you can reconfigure the certificate used for the encryption between your RDPGW and Hyper-V Hosts, like you did before.
    5.  Go to the table "tbl_ADHC_Host" and edit the key fk_ADHC_Host_VMM_CertificateStore and set "Enfore Foreign Key Constraint" back to "Yes".
    Hope that helps. ;)
    Best Regards,
    Marcus
    Marcus Lehmann

  • How do I create a folder so that my virtual machine can see it

    I have windows 7 and I also have Windows Virtual PC with a Windows XP virtual machine installed on my system.
    I would like to setup a folder on my windows 7 operating system and have my XP virtual machine see that folder.
    How can I do this?

    Hi
    Please take a look at this article:
    http://support.microsoft.com/kb/825086
    Best regards
    Joaquin Camarero Muñoz

  • Can you authenticate users from 2 different AAA-servers for one specific tunnel-group?

    I need to authenticate users from two separate AD LDAP databases on the same tunnel-group. I would like them to use the same tunnel-group and thereby using the  same group-alias. I tried creating a new aaa-server group and putting both LDAP servers into group but apparently the ASA does not roll through the separate servers in the aaa-server group and will stop if the first server states that the authentication failed.
    I also tried assigning multiple aaa-server groups into the tunnel-group authentication-server-group but that also did not work. I finally tried to create a separate tunnel-group and assigning it the same group-alias but the ASA will not allow me to assign the same group-alias to different tunnel-group. What is the best way to accomplish this without having to create a new group-alias that will show up and possible confuse the dumb users requiring this access? Please help.

    If you don't want ANY drop down I believe you can do it in a kludgy sort of way.
    Eliminate all the group aliases (which are used to populate the dropdown) and make a local database of the users for the sole purpose of assigning / restricting them to a non-default tunnel-group which authenticates to the secondary LDAP server. 
    You can also send out a non-published URL that points to a second tunnel-group not in the dropdown.
    Of course, we can accomplish this if the AAA server is ISE. ISE 1.3 can authenticate users to multiple AD domains (with or without trust relationships) or a single domain with multiple join points in the Forest.
    The ISE answer makes me wonder - could you establish trust between the domains and authenticate users that way?

  • DPM 2012 R2 Virtual machine - can you backup to disk then to TAPE

    I'm tasked with using DPM 2012 R2 to backup a 16 node 2012 R2 hyper-v CSV cluster. I will need to incorporate tapes in this scenario
    my DPM server is a virtual machine, on a 2 node cluster.
    what type of tape device can we use? FC or ISCSI? 
    Any ideas please let me know
    ANNCEX

    AFAIK, DPM being deployed as a virtual machine should
    work fine with ISCSI device. If the given device doesn't have ISCSI capability, you can utilize
    certain 3-party tool in order to make device visible via ISCSI protocol. We're using similar approach with Veeam in our environment.
    Kind regards, Leonardo.

  • Can't access emails from my Domain webmail usging ...

    Hello,
    I have totally failed to access emails from my domain webmail. Is there anyway you can help me to access  my webmail emails?
    Your help will be highly appreciated 
    Thank you
    Ronnie

    Well, if it's *web*mail, then you only need the browser!
    If you want to access it directly without using the browser, normally you have either POP3, IMAP or Exchange.
    POP3 and IMAP are supported by the standard e-mail client, with or without Nokia Messaging (the latter is only needed if you need the push functionality).
    If it's Mail for Exchange, you also have it integrated in your E75, so after typing your e-mail address you should get a question asking you which type of account is that.
    But first check (with your provider) which type of access you have to your e-mail. If you only get webmail, then you're stuck with the browser..

  • Can't receive mail from external domains (hotmail, gmail, etc)

    Hi,
    I have a new problem
    I can't receive external email. The receive connector that i have is the following:
    Default Frontend NAME.NL
    TlS, Basic verification, Basic after TLS, Intergrated, Exchange verification. groups: Exchange-server,
    exchange-user and anon
    This should be enough to receive external mail right? If I test it with gmail or hotmail I get the message: Mail delayed

    Hi,
    Is there any update?
    Thanks.
    Niko Cheng
    TechNet Community Support
    Sadly no.
    I still don receive any mail from certain domains. And gmail still has a +/- 24 hour delay. We now didn't receive some important mail for 1 and a half week. Any more idea's. I'm totally out of ideas 

  • Can not receive mail from outside domains

    We are setting up our OCS 10g mail server, and are having trouble setting up our policies.
    -unsure how to allow mail to come in from outside domains
    -are able to send mail to outside domains if that one is set. is there a way to allow to send to any outside domain without having to set every single one?

    it looks like the MX records are setup correctly now, but I am still unable to receive mail from outside domains.
    from a gmail address i get the error:
    Delivery to the following recipient failed permanently:
    [email protected]
    Technical details of permanent failure:
    TEMP_FAILURE: Could not initiate SMTP conversation with any hosts:
    [mydomain.com. (10): Connection timed out]
    ----- Original message -----
    Received: by 10.70.123.6 with SMTP id v6mr2951750wxc;
    Thu, 29 Jun 2006 05:22:06 -0700 (PDT)
    Received: by 10.70.105.2 with HTTP; Thu, 29 Jun 2006 05:22:06 -0700 (PDT)
    Message-ID: <[email protected]>
    Date: Thu, 29 Jun 2006 09:22:06 -0300
    From: "Chris M" <[email protected]>
    To: [email protected]
    Subject: test thursday 1
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary="----=_Part_77974_24025125.1151583726769"
    ------=_Part_77974_24025125.1151583726769
    Content-Type: text/plain; charset=ISO-8859-1; format=flowed
    Content-Transfer-Encoding: 7bit
    Content-Disposition: inline
    test
    ------=_Part_77974_24025125.1151583726769
    Content-Type: text/html; charset=ISO-8859-1
    Content-Transfer-Encoding: 7bit
    ----- Message truncated -----
    ** i modified the email addressed for the post, actual email addresses were used **

Maybe you are looking for