Users see all applications in RDS 2012 Web access in one-way trust domain environment

Hello!
We have RDS 2012 deployment in domainA.local. There is a one-way trust between domainA.local and domainB.local: A trusts B and B doesn't trust A.
A user from domainB.local authenticates in Web-access interface (wa.domainA.local) and sees
every published application in every collection in the deployment independently of UserGroups setting of collections and applications. This occurs for any domainB user.
In the security log of wa.domainA.local we can find an event :
An account failed to log on.
Subject:
Security ID:                IIS APPPOOL\RDWebAccess
Account Name:                RDWebAccess
Account Domain:                IIS APPPOOL
Logon ID:                0x2C7B16
Logon Type:                        3
Account For Which Logon Failed:
Security ID:                NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason:                An error occurred during logon
Status:                        0xC000005E
Sub Status:                0x0
Also in network trace on wa.domainA.local kerberos error could be found:
On TGS-REQ for krbtgt/[email protected] there is an answer: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7), server name krbtgt/domainB.
How to deal with this issue? The aim is to show only specified applications to domainB users.
Any help would be appreciated.

Hi,
Thank you for your posting in Windows Server Forum.
Please check below links might useful for your case.
“After adding the RDS server’s computer account to the Builtin Windows Authorization Access Group domain group, the RemoteApp icons displayed perfectly.” (Quoted from
this article)
1. Remote APP list empty
2. RD
Web Access unable to access Source (RD Server)
In respect to Kerberos Error, refer this link for troubleshooting.
1. Troubleshooting Kerberos Authentication problems – Name resolution issues
2. Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 2
Hope it helps!
Thanks,
Dharmesh

Similar Messages

Cannot share documents with few users in one way trusted domain

Hello
I am running in a wiered issue. I setup people picker in SP 2013 foundation version to lookup the user from one way trusted domains after which I started getting all the users from that domain in my intranet. I can also share or modify the permission of
users being administrator. However when I try to add 2 specific users as site collection administrator or try sharing a document, I get error.
I can lookup their name but when I try changing their permission or share document with them, I get error. It's wiered because it is only with this two users. there is no difference from Active Directory point of view between these and other users. Please
help or suggest some trouble shooting steps.
Regards,
Hardik Bhilota.

Hi Hardik,
What was the error message when sharing documents with the two users?
Please also check the ULS log for detailed error message which is located at C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS.
What is the permission of the two users in SharePoint site? Can they access the site?
Please also run the two commands below to see if the issue still occurs:
First, on every front-end Web server on a farm run this command:
STSADM.exe -o setapppassword -password key
Second, on a front-end Web server run this command:
STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv domain:DnsName,user,password -url http:// webapp
Best regards.
Thanks
Victoria Xia
TechNet Community Support

Hi skydiver, I have ios7.4, I tried two different USB ports and it still doesn't show,up on my desktops in my computer as iPad so I can't click it. If it was there I would open and see all my photos, and YES it ask me DO I trust this computer! several tim

Hi skydiver, I have ios7.4, I tried two different USB ports and it still doesn't show,up on my desktop in my computer as iPad so I can't click it. If it was there I would open and see all my photos, and YES it ask me DO I trust this computer! several times.
The apple tech on the phone, went to my control,panel
Went to my devices. Original iPad showed up,there In red and then he had me go,to apple website, download something and it said it could configure to my computer.
Is,finally answer,to me was go to the apple care,one on one appointment, and it's my "software"
A man I know told me "Apple at store, won't be able to do,anything for me"
That's not very positive.
What else? Can't I download iPad drivers,into my computer?

iPad not appearing in iTunes
http://www.apple.com/support/ipad/assistant/itunes/
iOS: Device not recognized in iTunes for Mac OS X
http://support.apple.com/kb/TS1591
iOS: Device not recognized in iTunes for Windows
http://support.apple.com/kb/TS1538
iTunes for Windows: Device Sync Tests
http://support.apple.com/kb/HT4235
IOS: Syncing with iTunes
http://support.apple.com/kb/HT1386
Apple - Support - iPad - Syncing
http://www.apple.com/support/ipad/syncing/
iTunes 10.5 and later: Troubleshooting iTunes Wi-Fi Syncing
http://support.apple.com/kb/ts4062
 Cheers, Tom

Rd web showing all remoteapps when logging in with an account of a trusted domain

we have a dmz with a separate domain. there is a one way trust to our local domain
In the dmz domain there is a rdweb and rd gateway. When logging in with an account from the dmz domain in the rdweb it's all fine but when logging in with an account from the trusted domain all remoteapp's are shown
all servers are 2012r2

Hi sir,
Please make sure your account has already added into your Pay-As-You-Go subscription as co-administrator role . If the account was not in your subscription please add it and try to login on from your VS again.
If you always occurred this issue, you can try to download the publish file and import it into you VS, please follow this steps:
http://azure.microsoft.com/en-us/documentation/articles/mobile-services-windows-how-to-import-publishsettings/
Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

SCCM 2012 R2 cross forest with one-way trust feasible?

We are planning to replace our existing SMS 2003 server with SCCM 2012 R2 (running on Windows server 2012 R2).
Our requirements are to support client our Windows 7 client PC's in Domain A and also support Xen Desktop clients in a separate domain (Domain B) and forest. We have a one way trust established (Domain B trusts Domain A). The SCCM 2012 R2 server will be
in Domain A the same as our current SMS 2003 server.
What we want to do, at a minimum, using SCCM is:
Client inventory (hardware, software, user) and package distribution.
Is this do able or a no go? If not directly is there any work-around for this? Appreciate any helpful advice or feedback.
I have made the below diagram to better illustrate the scenario:
Note: Domain B does not have WINS implemented (Domain A does). Both domains are running DNS of course.

Hi,
The following blog describes the technical requirements that have been put in place for the support of cross forest communication. You could have a look.
Quote:
Inner-site Communication (site to site communication) exists in the form of both File Based Replication (SMB Port 445) and Database Replication (TCP/IP port 4022 by default).
In order to install and configure a child site (primary or secondary), the child site server must be located in the same forest as the parent site or reside in a forest that contains a
two way trust with the forest of the parent (CAS or primary).
Site System Roles (MP, DP, etc.) with the exception of the Out of Band Service Point and the Application Catalog Web Service Point can be deployed in an untrusted forest.
The SLP functionality as known in ConfigMgr 2007 is now performed by a Management Point. In this blog I will refer to this as the Lookup Management Point.
Most of these items were taken from this TechNet article – please refer to the article for more information -
Planning for Communications in Configuration Manager .
For more information:
http://blogs.technet.com/b/neilp/archive/2012/08/20/cross-forest-support-in-system-center-2012-configuration-manager-part-1.aspx
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.
Thank you for your reply. The below appears to make it seem as though this can be accomplished without requiring a trust:
http://blog.coretech.dk/kea/multi-forest-support-in-configmgr-2012-part-i-managing-clients-in-an-untrusted-forest/#comment-284522
Not sure which is correct...

Active Directory: One Way Trust from NT Domain to 2003 Domain being upgraded to 2012 R2

We have an old legacy NT 4 domain that is slowly being decommissioned. (Slowly is the key word) Currently there is a one way External Trust between those NT 4 domains and a child domain that is at 2003 functionality. We are in the middle of upgrading
those child domain and the root domain to 2012 R2. My only concern right now and I can't seem to find concert proof either way, but will that external one way trust break when upgrading the forest and domain functionality to 2012 R2 once we
have all our DC's upgraded? I have read articles on how to get that trust to work in a 2008 R2 domain and of course it is working with the existing 2003 domain.
In theory the trust should break, correct? However, I know there are some security changes among other things in 2012 that may or may not work.
Kristopher Turner | Not the brightest bulb but by far not the dimmest bulb.

Yes. We are working with the client to migrate any dependencies off these 3 NT legacy domains. We will be able to decommission 2 of the 3 without any issues. However, they still have an old NT box running SQL 6.5 databases for a application still in
production. Yes, they are very aware that NT isn't supported, that that version of SQL isn't supported, and that this will hold up their upgrade.
Our plans for them will be to deploy all new Windows Server 2012 R2 domain controllers but keep the domain and the forest functionality at 2003 in order to support that final NT Legacy domain until they can get that application migrated.
Once that NT domain is decommissioned then we can raise the functionality of the rest of their domains from 2003 to 2012 R2.
Kristopher Turner | Not the brightest bulb but by far not the dimmest bulb.

One way trust relationship between different domain windows server 2012 in different forest

I'd like to build trust correctly between the domains A.local and B.int. A.local is on a Windows 2012 . B.int is on a Windows 2012 . Both machines are
connected to the same LAN. The forest level in A.local
machine is Windows Server 2008 and The forest level in B.int
is Windows server 2012.
I want a one-way trust relationship, i.e. users from A.local gain access to B.local.
my problem it i create the trust put when i go to validate the trust between A.Local and B.int give me this error :
The secure channel (SC) reset on Active Directory Domain Controller \\dc2.B.int of domain B.int to domain A.Local failed with error: There are currently no logon servers available to service the logon request.
NOTE : Recently I
UPGRADE THE Active Directory FROM 2008 R2 TO 2012 and i ping on A.local to B.int
it is ping by name and IP but from b.int ping by IP JUST >>>
ihab

Hi,
yes i already do it the setup conditional forwarding between the 2 domains and
the firewall it is off
ihab

I added a contact to my iphone 4s and when I did a sync manually it is not showing up on my MAC in address book - please help....I checked off sync all contacts in iTunes - does it only work one way from computer to phone?

I added a contact to my iphone 4s and when I did a sync manually it is not showing up on my MAC in address book - please help....I checked off sync all contacts in iTunes - does it only work one way from computer to phone?

Is it because the new itunes looks different.
View > Show Sidebar
Then it should work just the same as on your old computer.

Lost window, using published application on server 2012, when access it via web remote.

Hi,
We use an edi software installed on a Server 2012.
When we use this software accessing the server by Remote Desktop, everything works normal.
When we use the same software accessing the server by web access, (...softname/RDWeb/Feed/webfeed.aspx) where was published this soft application, we lost some windows after different actions.
For example if I do a modification for a value in one specific window, after I click save, that window disappear but can appear again only if I click again anywhere on my desktop.
In other words that window lost the focus and probably is still open under another window. Clicking again anywhere, will reactivate it and that window appear again.
Can you please help me to find a solution to this problem?
Thank You!

Hi,
For example if I do a modification for a value in one specific window, after I click save, that window disappear but can appear again only if I click again anywhere on my desktop.
Would you please tell us which window and what has been modified specifically?
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Why can't a user see all files in a network share?

Windows Server 2008 R2 is sharing a folder. Advanced Sharing permissions give Everyone Full Control.
NTFS Permissions give the OU "Operations" read/modify permissions.
In the Operations OU, 1 user (let's call him John) cannot see all the files in this folder. For example, here is the real contents of the folder:
File1
File2
File3
File4
File5
Everyone in the Operations OU sees all the files, except John. When John opens the folder, he sees:
File2
File4
File5
Several files are simply missing from the list. I have no idea where to look for help on this one. The files are dynamically added to the folder each day, and each day are cleared out. So every day it is a new set of files being generated (they are coming
from a PDF printer). There is no pattern to which files John can see, and which he cannot. Does anyone have any ideas?
Jesse

I had the same problem, and it was related to permissions. My PCs are now running Windows 8.1 and folder properties are set to display file name extensions of all files. The 2 invisible files are File1 and File3 in your example. I have copied them to
both PCs. Computer A can see them on its own drive, and on computer B via UNC. Computer B can see them on its own drive, but not
on computer A via UNC. The cause: computer B didn't have permissions on these 2 files on computer A. I was starting the UNC directly from File Explorer, and, in my case, this uses HomeUsers for permissions (over my home network). So, on computer A, I gave
permissions on these 2 files to the user HomeUsers and that fixed the problem. I will also create a more general solution using inherited permissions.
Specifically, I selected the file and chose properties/security/advanced/add/select a principal, then typed HomeUsers "Check Names", OK, and selected the desired permissions. This fits your situation: the files are being created automatically and
don't have the correct permissions for the other PC to see them. Inherited permissions should fix it.
Tom

RDS 2012 External access for Session Hosts over different port to default 443

Hello there
I am having problems solving this problem as you may see on other posts, so I am going to try again.
I have two Server 2012 machines for RDS. Server 1 one with all roles (Gateway, Broker, Session host etc.) and second machine, Server 2 as a session host only. I am running RDWeb Apps, with CA certificate installed and
everything works fine internally.
Due to limitations on the router I had to change the default SSL port on the gateway (Server 1) to 4043. I have this and 3391 for UDP open to Server 1 from the router.
Working externally, I can login to the RDS site and open apps form Server 1, but when I try to open an app installed on Server 2, I get a certificate error. The error is:
“Your computer can’t connect to the remote computer because the Remote Desktop Gateway server address
and the certificate subject name do not match. Contact your network administrator for assistance".
The certificate address the error points to is referring to is an SBS 2011 cert for RWW and email. Experimenting, if I use 443 on the Server 1
gateway instead of 4043 and change the router accordingly, it then works. I can open apps form both session hosts externally . But not if is set to 4043.
For the record Server 2 session host also gives this error:
Event ID: 1280 Warning Microsoft Windows TerminalServcies-session broker client
Remote Desktop Services failed to join the Connection Broker on server sever-vm1.local.
Error: Current async message was dropped by async dispatcher, because there is a new message which will override the current one.
Because everything works fine using default 443, I figure this is a communication or firewall issue between the gateway and the session host on Server 2.
Can anyone help here?
Many Thanks
MIS5000

Hi,
Thanks for your comment.
Have you check the connection on your second server?
Can you ping the server 2 from server 1?
As from the event ID 1280 it seems there is some network connectivity to RDCB server. Also please “Add the RD Session Host server to the Session Broker Computers group” & RDWeb server's computer account needs to be a member of the local TS Web Access Computers
group on your RDSH server. You can get the detailed information from this article.
In addition, do you have certificate purchased and install from trusted root authority. There is some requirement to use certificate for RDS environment, please consider following points.
1. The certificate is installed into computer’s “Personal” certificate store.
2. The certificate has a corresponding private key.
3. The "Enhanced Key Usage" extension has a value of either "Server Authentication" or "Remote Desktop Authentication" (1.3.6.1.4.1.311.54.1.2). Certificates with no "Enhanced Key Usage" extension can be used as well.
You can get more details regarding certificatehere.
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support

RDS 2012 R2 cannot add 3rd party (parent domain) licensing server

Hi,
I have a RDS 2012 R2 farm and i cannot add a 3rd party licensing server that is in a parent domain (forest root domain - hosted by our corp HQ). I will edit deployment properties for the deployment in the first CB server to add a licensing server in per
user mode. Seemes to work, however no licenses are given to SH servers. Have made GPO aswell to explicitly specify licensing server and mode, however i think this should not be neccessary.
Any ideas?
This posting is provided "AS IS" with no warranties or guarantees and confers no rights

Hi,
Thank you for posting in Windows Server Forum.
1. In Server Manager -- RDS -- Overview -- Tasks -- Edit Deployment Properties -- RD Licensing tab, please make sure that the Licensing mode is set to match the type of licenses you purchased, and that the FQDN of your RD Licensing server is listed.
2. In Server Manager -- RDS -- Collections -- <your collection> -- Host Servers, please make sure that your RDSH server is listed. If you have more than one server with the RDSH Role Service in your deployment make sure that all of them are
listed. If they are not you may click Tasks -- Add RD Session Host Servers (make sure the servers are part of the Server Manager server pool prior to this).
3. On Server 1, please open an Administrator PowerShell prompt and enter the following command:
Add-WindowsFeature RDS-Licensing-UI
4. After the above powershell command completes you should be able to open RD Licensing Manager (licmgr.exe) on Server 1 if you need to. Please note that it is more important to have the licensing configured properly in deployment properties and your
RDSH servers part of a collection than it is to be able to open RD Licensing Manager on both of your servers.
(Above one quoted from beneath thread)
Source:
RDS 2012 Can't add a licensing server
In addition, check below article.
RD Licensing Configuration on Windows Server 2012
Hope it helps!
Thanks.
Dharmesh Solanki

Publish RD Gateway and Web Access with One-Time Password (OTP) / Two-factor Authentication WITHOUT ISA/TMG server

Hi everybody,
I've been struggeling with this problem for a few weeks now and can't find a way to solve it.
We have an RD farm (Server 2012) which consists of two Remote Desktop Servers with Connection Broker and Web Access.
I've recently published a new server, containing RD Gateway and Web Access in our perimeter network.
Now we've got restrictions that OTP/2FA must be used for the external deployment and we've decided to go for a solution from Gemalto.
The "program" is called IDConfim and the server is called SA Server (Strong Authentication).
Also it's important that NO ISA/TMG server is supposed to be used, the OTP/2FA is supposed to work seamless with the Web Access/Gateway.
After hours discuss we came to a point were their NPS agent setup would be the only way to accomplish our goals.
The setup is supposed to be like this:
LAN:
1 DC (2008 R2)
RD Farm (2012)
1 SA Server (2012)
DMZ:
RD Gateway/Web Access (2012)
Were Gateway and Web Access should forward the authentications with NPS to the NPS agent on the SA server.
When you print your AD account to authenticate you add the 6 digits of OTP which you recieve from you mobile app.
Initially this seems to work, the Gateway forwards the request to the remote NPS server, BUT only if you write the correct AD password
(without the OTP extension).
If you write the correct AD password the authentication is forwarded to out SA Servern and it's beeing rejeced because the password doesn't
contain the correct OTP extension.
The problem comes here.
When you write you AD password along with the OTP extension you get a Windows Security error in the eventlog (On thw Gateway server) like this:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user
Account Domain: domain
Failure Information:
Failure Reason: Unknown username or password.
Status: 0xc000006d
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: server
Source Network Address: 192.168.x.x
Source Port: 63003
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
What i can see it's a NTLM error, but hey?! aren't we supposed to forward all authentication handeling to the remote NPS server?
The problem is that no matter what i try the above problem stays there.
Is it not possible to just forward ALL authentication handeling to a remote server?
The only solution I've found to get it working someday in the future is this:
"Remote Desktop Pluggable Authentication and Authorization", which is supposed to be introduced in 2012 R2.
Also this link describes it:
http://archive.msdn.microsoft.com/Release/ProjectReleases.aspx?ProjectName=rdsdev&ReleaseId=3745
Please, bring me some answers before my head explodes! :)
PS, long question = maybe some errors, ask me if something is unclear.

Hi,
Based on our experience, if the NTLM error occurs, please check the password.
Regards,
Mike
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Administrator User seeing all Zeroes in a Report

Wondering how to resolve this.
This is on BPC version 7.5 SP4, NW.
I have a user who has full administrative rights, yet whenever he opens a report, it begins opening up and shows the correct non-zero data, yet by the time it is fully loaded and refreshed, it shows all zeros for him.
What I've done in an attempt to resolve:
- Double checked his current view settings - no issues
- Had him try on another computer - same issue
- I tried with my userid on his computer, and I was able to get it to work
- I double checked his security and rights - exact same as mine
- I even deleted and re-added him, ensuring our security and rights were the same - still same issue
- I did a clear by going to eTools->Client Options->Clear Local Application Information - still same issue
- I ensured he and I were seeing the exact same report
The only difference is - he has both Excel 2003 and Excel 2010 on his machine, while I only have Excel 2010. Not sure if that is an issue.
Does anyone have any insights as to why he keeps seeing zeros each time he opens this report?

Hi,
When you save an excel sheet in the BPC file server, it is saved as it is. This means, if a cell has a value while saving the report, then excel sheet is saved with that value in it in the file server.
If you have set the excel sheet to expand and/or refresh while opening, the excel report is opened by BPC for excel and the excel values are updated after the excel cells are refreshed from DB. In between the time of opening the excel sheet and the automatic expansion/refresh, you will be able to see the values that are stored in the excel sheet while you have saved it.
To overcome this, you must save the excel sheet without the values in any approach possible for you (like changing the Current View, or clearing the data and compressing it) and save it, so that when saving the excel sheet there will be no visible data. The data will then be retrieved only after refreshed/expanded.
The advantages of doing so are;
1) User will not be confused on why some data seems to disappear when opening the SAP BPC report. In reality, it is not. Its just retrieving the data from DB and refreshing the excel sheet.
2) The more the data in excel sheet, the bigger the size and the slower loading of cached files while logging in. So, when you remove those data, the excel size will be small and the excel sheet will be loaded faster while downloading cached files while logging in.
Hope this is the problem you are facing.
Karthik AJ

GPO - Restricts the UI languages Windows should use for the selected user - not applying correctly on RDS 2012 R2

Hi All,
we have a Citrix XenApp 7.5 Farm with Windows Server 2012 R2 Servers and multiple (english, german, italian, spanish, french...) languages installed.
I've created a GPO with settings 'Restricts the UI languages Windows should use for the selected user' to for example 'German'.
Now when a user logs on to the server, the UI language is in german, but when i open Control Panel\Language: There is still English (United States) with Keyboard Layout: US, German.
It seems that the GPO is not changing all settings correctly to german.
Does anybody know what could be wrong?
best regards,
Siegmund

Hi Siegmund,
>>Now when a user logs on to the server, the UI language is in german, but when i open Control Panel\Language: There is still English (United States) with Keyboard Layout: US, German
Based on the description, the policy setting should have been applied successfully. Here, did we logged onto the server via remote desktop services? If yes, what's the keyboard layout on the computer we used to RDP to the server? Before going further,
I assume that this can be caused by Auto detect Remote Keyboard layout feature introduced since Windows Server 2008.
Regarding this point, the following artcile can be referred to for more information.
Windows 2008 R2 Language Bar keeps changing Keyboard Settings
http://www.microsoftpro.nl/2011/02/24/windows-2008-r2-language-bar-keeps-changing-keyboard-settings/
Note: For the above website is not hosted by Microsoft, the link may become invalid without notice and Microsoft doesn't guarantee the accuracy of the information.
In addition, the following thread can also be referred to for more information.
2008 R2 Session Host with MUI controlled via Group Policy
http://social.technet.microsoft.com/Forums/windowsserver/en-US/4e14955a-80f9-40aa-9741-fc8609f4ad09/2008-r2-session-host-with-mui-controlled-via-group-policy?forum=winserverGP
Best regards,
Frank Shen

Users see all applications in RDS 2012 Web access in one-way trust domain environment

Similar Messages

Maybe you are looking for