I can login by hostname but can't by ip

Question

Hi,
There is a strange problem. After some updates on DC and adding new Exchange server 2013 to domain I can't login with Remote Desktop Connetion (RDP) to another PC in local network by IP address and AD account and if remote PC is Win 7, 8.1 or Server 2012.
Error is:
Your credentials did not work
The credentials that were used to connect to 10.200.200.20 did not work.
Please enter new credentials.
The logon attempt failed
If I try RDP by hostname to the same remote PC with the same credential there is no problem.
Remote computers with old OS like XP and Server 2003 are not affected. Also when remote PC is logged to AD first by its local keyboard then I can RDP sometime by IP. But after restart its impossible by IP. Only by hostname.
Another issue: shared folders are accessed by hostname: \\servername\shared_folder\  But by IP \\10.200.200.20\shared_foder\ continuesly asking for username and password:
Enter network credentials
Enter your credentials to connect to: 10.200.200.20
The user name or password is incorrect.
I have test DNS and WINS - Forward and Reverse zones are OK.
IP6 is dissabled.
Another ting that I make a day before is from Active Directory Domains and Trusts I add a Alternative UPN suffixes, but I removed it after that. Is this may corrupted someting!?
This is log:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 17.3.2015 г. 15:36:59
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: ServerExchange1.mydomain.com
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: [email protected]
Account Domain:
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xC000006D
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: PC2
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-03-17T13:36:59.119680200Z" />
<EventRecordID>788477</EventRecordID>
<Correlation />
<Execution ProcessID="628" ThreadID="1532" />
<Channel>Security</Channel>
<Computer>PolyExchange1.mydomain.com</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-0-0</Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid">S-1-0-0</Data>
<Data Name="TargetUserName">[email protected]</Data>
<Data Name="TargetDomainName">
</Data>
<Data Name="Status">0xc000006d</Data>
<Data Name="FailureReason">%%2304</Data>
<Data Name="SubStatus">0x0</Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">NtLmSsp </Data>
<Data Name="AuthenticationPackageName">NTLM</Data>
<Data Name="WorkstationName">PC2</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data>
<Data Name="ProcessName">-</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
</EventData>
</Event>
This is the netlogon.log :
03/15 15:42:35 [MISC] [684] DbFlag is set to 2080ffff
03/15 15:42:37 [INIT] [1552] Group Policy is not defined for Netlogon
03/15 15:42:37 [INIT] [1552] Following are the effective values after parsing
03/15 15:43:04 [LOGON] [5048] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:43:04 [CRITICAL] [5048] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:43:04 [LOGON] [5048] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:43:09 [LOGON] [668] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:43:09 [CRITICAL] [668] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:43:09 [LOGON] [668] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:43:16 [MISC] [5048] DsGetDcName function called: client PID=992, Dom:(null) Acct:(null) Flags: PDC BACKGROUND RET_NETBIOS
03/15 15:43:16 [MISC] [5048] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c07ffff1
03/15 15:43:16 [MAILSLOT] [5048] NetpDcPingListIp: mydomain.local.: Sent UDP ping to 10.200.200.10
03/15 15:43:16 [MISC] [5048] NetpDcAllocateCacheEntry: new entry 0x0000006765B8A490 -> DC:SERVERDC1 DnsDomName:mydomain.local Flags:0x3fd
03/15 15:43:16 [MISC] [5048] NetpDcGetName: NetpDcGetNameIp for mydomain.local. returned 0
03/15 15:43:16 [MISC] [5048] DsGetDcName: results as follows: DCName:\\SERVERDC1 DCAddress:\\10.200.200.10 DCAddrType:0x1 DomainName:MYDOMAIN DnsForestName:mydomain.local Flags:0x800003fd DcSiteName:Polycomp-Sofia ClientSiteName:Polycomp-Sofia
03/15 15:43:16 [MISC] [5048] DsGetDcName function returns 0 (client PID=992): Dom:(null) Acct:(null) Flags: PDC BACKGROUND RET_NETBIOS
03/15 15:43:19 [MISC] [5048] DsGetDcName function called: client PID=992, Dom:(null) Acct:(null) Flags: PDC BACKGROUND RET_NETBIOS
03/15 15:43:19 [MISC] [5048] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c07ffff1
03/15 15:43:19 [MISC] [5048] NetpDcGetName: mydomain.local. using cached information ( NlDcCacheEntry = 0x0000006765B8A490 )
03/15 15:43:19 [MISC] [5048] DsGetDcName: results as follows: DCName:\\SERVERDC1 DCAddress:\\10.200.200.10 DCAddrType:0x1 DomainName:MYDOMAIN DnsForestName:mydomain.local Flags:0x800003fd DcSiteName:Polycomp-Sofia ClientSiteName:Polycomp-Sofia
03/15 15:43:19 [MISC] [5048] DsGetDcName function returns 0 (client PID=992): Dom:(null) Acct:(null) Flags: PDC BACKGROUND RET_NETBIOS
03/15 15:43:35 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:43:35 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:43:35 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:44:05 [LOGON] [5048] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:44:05 [CRITICAL] [5048] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:44:05 [LOGON] [5048] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:44:22 [LOGON] [668] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:44:22 [CRITICAL] [668] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:44:22 [LOGON] [668] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:45:32 [SESSION] [668] I_NetLogonGetAuthData called: (null) mydomain.local (Flags 0x1)
03/15 15:46:16 [MISC] [684] DsGetDcName function called: client PID=1124, Dom:(null) Acct:(null) Flags: DS BACKGROUND
03/15 15:46:16 [MISC] [684] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c07ffff1
03/15 15:46:16 [MISC] [684] NetpDcGetName: mydomain.local. using cached information ( NlDcCacheEntry = 0x0000006764A97440 )
03/15 15:46:16 [MISC] [684] DsGetDcName: results as follows: DCName:\\SERVERDC2.mydomain.local DCAddress:\\10.200.200.15 DCAddrType:0x1 DomainName:mydomain.local DnsForestName:mydomain.local Flags:0xe00001fc DcSiteName:Polycomp-Sofia ClientSiteName:Polycomp-Sofia
03/15 15:46:16 [MISC] [684] DsGetDcName function returns 0 (client PID=1124): Dom:(null) Acct:(null) Flags: DS BACKGROUND
03/15 15:47:34 [SESSION] [1552] MYDOMAIN: NlTimeoutApiClientSession: Unbind from server \\SERVERDC2.mydomain.local (TCP) 0.
03/15 15:52:34 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:52:34 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:52:34 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:52:35 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:52:35 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:52:35 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:52:40 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:52:40 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:52:40 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:52:46 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:52:46 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:52:46 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:53:15 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Entered
03/15 15:53:15 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:53:15 [LOGON] [684] SamLogon: Network logon of (null)\[email protected] from PC1 Returns 0xC000006D
03/15 15:53:38 [LOGON] [684] SamLogon: Network logon of MYDOMAIN\USER1 from PC1 Entered
03/15 15:53:38 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:53:38 [LOGON] [684] SamLogon: Network logon of MYDOMAIN\USER1 from PC1 Returns 0xC000006D
03/15 15:53:40 [LOGON] [684] SamLogon: Network logon of MYDOMAIN\USER1 from PC1 Entered
03/15 15:53:40 [CRITICAL] [684] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonWithFlags: 1761 (may be legitimate for 0xc000006d)
03/15 15:53:40 [LOGON] [684] SamLogon: Network logon of MYDOMAIN\USER1 from PC1 Returns 0xC000006D
03/15 15:53:41 [MISC] [4288] DsGetDcName function called: client PID=1124, Dom:MYDOMAIN Acct:(null) Flags: RET_DNS
03/15 15:53:41 [MISC] [4288] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c07ffff1
03/15 15:53:41 [MISC] [4288] NetpDcGetName: mydomain.local. using cached information ( NlDcCacheEntry = 0x0000006764A97440 )
03/15 15:53:41 [MISC] [4288] DsGetDcName: results as follows: DCName:\\SERVERDC2.mydomain.local DCAddress:\\10.200.200.15 DCAddrType:0x1 DomainName:mydomain.local DnsForestName:mydomain.local Flags:0xe00001fc DcSiteName:Polycomp-Sofia ClientSiteName:Polycomp-Sofia
03/15 15:53:41 [MISC] [4288] DsGetDcName function returns 0 (client PID=1124): Dom:MYDOMAIN Acct:(null) Flags: RET_DNS
03/15 15:54:08 [MISC] [4564] DsGetDcName function called: client PID=992, Dom:mydomain.local Acct:(null) Flags: BACKGROUND DNS
03/15 15:54:08 [MISC] [4564] NetpDcInitializeContext: DSGETDC_VALID_FLAGS is c07ffff1
03/15 15:54:08 [MISC] [4564] NetpDcGetName: mydomain.local using cached information ( NlDcCacheEntry = 0x0000006764A97440 )
03/15 15:54:08 [MISC] [4564] DsGetDcName: results as follows: DCName:\\SERVERDC2.mydomain.local DCAddress:\\10.200.200.15 DCAddrType:0x1 DomainName:mydomain.local DnsForestName:mydomain.local Flags:0xe00001fc DcSiteName:Polycomp-Sofia ClientSiteName:Polycomp-Sofia
03/15 15:54:08 [MISC] [4564] DsGetDcName function returns 0 (client PID=992): Dom:mydomain.local Acct:(null) Flags: BACKGROUND DNS
03/15 15:54:56 [INIT] [1416] Group Policy is not defined for Netlogon

Answer 1

> \\servername\shared_folder\  But by IP \\10.200.200.20\shared_foder\
> continuesly asking for username and password:
DCs running 2003? Then install the re-released KB3002657 on all your
2003 DCs.
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-: