Windows 2008 R2 AD auth for computer account

I am trying to use new computer account created in Windows 2008 R2 Active Directory from my external LDAP client. The LDAP client connection fails to connect displaying error "AcceptSecurityContext error, data 710, v1db1". The credentials
and other connection details are all correct. I see the same error code when I attempt to use localhost ldp.exe client from Windows 2008 server.
The audit failure log for the failed attempt has status code 0xC0000199 for which the description says "The account used is a computer account. Use your global user account or local user account to access this server."
I am able to use computer account in Windows 2003 server from my LDAP client, and authentication works fine. Is there a special security setting required to make it work in Windows 2008 R2?.
Could anyone please help me here? Thanks

Hi,
So if here this account is used as service account, then check here:
http://technet.microsoft.com/en-us/library/ff641731(v=ws.10).aspx
http://social.technet.microsoft.com/wiki/contents/articles/391.managed-service-accounts-msas-versus-virtual-accounts-in-windows-server-2008-r2.aspx
Rgds

Similar Messages

SDK service using domain user trying to set SPN for computer account

I have a SDK service running under a domain user account, but it tries to register the SPN for the computer account of the machine?!
Therefore I get the following alert:
The System Center Data Access service failed to register an SPN. A domain admin needs to add MSOMSdkSvc/WIN-9IAJC0HS9RJ and MSOMSdkSvc/WIN-9IAJC0HS9RJ.domainxx.local to the servicePrincipalName of CN=WIN-9IAJC0HS9RJ,CN=Computers,DC=domainxx,DC=local
Which makes sense because it has not the permissions to do that.
When I make the domain user account member of domain admins it has the concerning permissions and it indeed registers that SPN to the computer account. But why?? The SPN should be registered to the domain user account instead (and therefore I had given the
domain user account the read/write permissions to itself to do that).
I have the following SPN registered now for the computer and domain user account:
setspn -l WIN-9IAJC0HS9RJ
Registered ServicePrincipalNames for CN=WIN-9IAJC0HS9RJ,CN=Computers,DC=domainxx
DC=local:
MSOMSdkSvc/WIN-9IAJC0HS9RJ
MSOMSdkSvc/WIN-9IAJC0HS9RJ.domainxx.local
MSOMHSvc/WIN-9IAJC0HS9RJ
MSOMHSvc/WIN-9IAJC0HS9RJ.domainxx.local
TERMSRV/WIN-9IAJC0HS9RJ
TERMSRV/WIN-9IAJC0HS9RJ.domainxx.local
WSMAN/WIN-9IAJC0HS9RJ
WSMAN/WIN-9IAJC0HS9RJ.domainxx.local
RestrictedKrbHost/WIN-9IAJC0HS9RJ
HOST/WIN-9IAJC0HS9RJ
RestrictedKrbHost/WIN-9IAJC0HS9RJ.domainxx.local
HOST/WIN-9IAJC0HS9RJ.domainxx.local
setspn -l domainxx\omdas
Registered ServicePrincipalNames for CN=OMDAS,CN=Users,DC=domainxx,DC=local:
none for this account
I don't get it. Anyone?
I am using SCOM 2012 R2
Pls help.
Thanx in advance.
Regards
Chris

SCOM SDK service really tries to set its SPN to the computer account (although the SDK service is running using a domain user account). The alert is no bug!
I know this for sure because I gave the SDK service permission to do it - by making the domain user account member of the domain admins security group - and it indeed sets the SPN on the computer account.
The latter is the actual bug I would say! It should try to set the SPN for the domain user account the sdk service is running with.
Then again, nog having the SPN been set correctly to this domain user account, does not seem to bother SCOM at all indeed. Perhaps it uses NTLM instead in this scenario.
Can anyone comfirm?

LastLogonTimeStamp Attribute Not Updated for Computer Account Over SSL-VPN

We like to use LastLogonTimeStamp (LLTS) to find stale computer accounts, disable them, and eventually delete time. What we have found is that domain member computers that connect to the domain exclusively by SSL-VPN (for instance in the case of employees
who work from their home office) do not update LLTS. Consequently these computers frequently appear on stale computer reports.
I suppose the required logon type is never used when connecting over SSL-VPN. Therefore I would like to know if there is a way via a logon script or some other method that we can update this attribute.

That is normal as you connect to VPN using locally cached credentials for the user and the computer accounts.
My recommendation to track these computers is to have an agent that periodically report the computer status (Example: Using Microsoft Intune) or have a scheduled task that will run a script when the user is connected to VPN and register the computer name
as active in a file that is hosted in a share.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

ORA-12560:TNS:protocol adapter error on windows 2008 server(32 bit) for 10g

Hi Friends,
I am installaing Oracle 10g database on windows 2008 Server(32-bit) and when the Database is getting cretaed and during the database files copying portion it's throwing the error :
ORA-12560: TNS:protocol adapter error
I tried intsllaing 10g software alone and invoked DBCA and again during the database files copying portion it's throwing the same error
what could be the issue?
Regards,
DB

Pl indicate which version of "10g" and which version of Windows 2008 - R1 or R2 ?
HTH
Srini

Window 2008 R2 DHCP setup for /21 subnets

I have a 2008 r2 domain server that I am setting up separate client DHCP scopes. One for regular wireless network and one for the guest network. I followed the same process to create both but they both created differently when viewed in the DHCP
mgmt interface. The .40 is working, the clients grab the next available IP and they are off. The .50 is not working correctly or the same way. See detail below.
I created a Scope for the wireless network clients 10.100.40.0 /21 Range 10.100.40.1-47.254 subnet mask 255.255.248.0 The
scope created as a super scope and added scopes .40 .41 .42 .43 .44 .45 .46 .47 (all as separate scopes under the super scope) for distribution which is accurate according to the subnet calculator. I excluded 40.1-10. It works! clients fill up
.40 and move to .41 etc. Statistics total scopes 8, total addresses 2023, in use 874, available 1149.
I created a scope for the guest wireless network clients 10.100.50.0 /21 same way! Range 10.100.48.1-55.254 (according to the subnet calculator)
subnet mask 255.255.248.0 The scope created as a regular scope 10.100.48.0 /21 starting address assigned is in the 48 subnet. I excluded 10.100.50.1-10. Statistics total scopes listed none ( no line), total addresses 2036, in use 262, available
1774.
I would prefer they both be set up the same way and functioning. As I said earlier .40 is working great! but .50 seems to have some .48 clients, 3 49 clients and a small group for 50 starting from the exclusion. I am not sure it is working
correctly ... I have had several people tell me that they are not able to grab an IP on the guest network. I have tried to recreate several time with out any different results.
Anyone have any ideas why .50 is different and what I could do to fix this? Thanks! chabo
chabt

Hi chabt,
Based on your description, I suppose that when you use
New Scope Wizard to create the super scope, you choose 24 in the
Length edit of Configuration settings that propagate to DHCP Client, that is to say, the subnet mask is 255.255.255.0. Then the New Scope Wizard will prompt you create a superscope because the address range you specified is
too large for a single scope. If the subnet mask is 255.255.248.0, it won’t prompt you create a superscope.
About the Statistics displaying, please try to restart DHCP server to see if it can display normally.
About the problem that several users couldn’t obtain an IP address, because other users can get IP addresses, please check if they match the policies on your guest network.
Also, please check the DHCP logs to see if the DHCP server logged any related logs. Such as, you could find if the lease was denied, or if the DHCP server received the DHCP request or other useful information.
The dhcp logs are stored in %windir%\System32\dhcp. Please ensure that the DHCP server enabled audit logging.
To enable DHCP audit logging, in the DHCP console, right click
IPv4, click Properties, in the General tab, check “Enable DHCP audit logging” checkbox.
For more details about DHCP audit logging, please refer to the article below,
More About DHCP Audit and Event Logging
http://technet.microsoft.com/en-us/library/dd759178.aspx
Best Regards,
Tinac

2008 Failover cluster unable to create computer account

Hello,
I have created a 2008 R2 Failover cluster and I am trying to add a Fail over File server to this.
I get the dreaded
Cluster network name resource 'OfMaClusterFS' failed to create its associated computer object in domain 'xxx.domain' for the following reason: Unable to create computer account.
The text for the associated error code is: Access is denied.
Please work with your domain administrator to ensure that:
- The cluster identity 'OFMACLUSTER$' can create computer objects. By default all computer objects are created in the 'Computers' container; consult the domain administrator if this location has been changed.
- The quota for computer objects has not been reached.
- If there is an existing computer object, verify the Cluster Identity 'OFMACLUSTER$' has 'Full Control' permission to that computer object using the Active Directory Users and Computers tool.
I have created clusters frequently in the past, on my own Domains that I am a domain admin of. Now I am trying to make one on our larger corporate domain that I am not a domain admin of and get this error.
By default, domain users can not add computer accounts to our domain. I do however have an limited account that can add computers to the domain... but I have tried all the tricks I can think of to try and add the Network name to AD and no luck.#
I have tried running the cluster service with this account, but it is still trying to use the OFMACLUSTER$ identity to create the Network name. I have tried manually creating the network name using my limited account, but that doesn't work either,
same error. I don't have the ability to change permissions on the computer name I added for the network name to AD.
I have raised a ticket to our wintel team to try and get them to help, but they aren't exactly the most responsive bunch. I'm just wondering what the best way around this problem is if I am not a domain admin and I can't make the changes I need, or
what concise instructions I can give to the domain admins so that they can help me out without saying that it is a security breach etc.
I would appreciate any advice on this as it's now urgent and also something I will have to do in the future fairly regularly and don't want to get caught in the situation in the future.

Hi jogdial,
To create a cluster, the minimum permission is: Requires administrative permissions on the servers that will become cluster nodes. Also requires
Create Computer objects and Read All Properties permissions in the container that is used for computer accounts in the domain.
If you create the cluster name account (cluster name object) before creating the cluster—that is, prestage the account—you must give it the
Create Computer objects and Read All Properties permissions in the container that is used for computer accounts in the domain. You must also disable the account, and give
Full Control of it to the account that will be used by the administrator who installs the cluster.
The related KB:
Failover Cluster Step-by-Step Guide: Configuring Accounts in Active Directory
http://technet.microsoft.com/en-us/library/cc731002(v=ws.10).aspx
More information:
How to Create a Cluster in a Restrictive Active Directory Environment
http://blogs.msdn.com/b/clustering/archive/2012/03/30/10289577.aspx
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Preparing User Accounts on windows 2008 R2

Hi ,
To create account for hyperion installation purpose oracle documents says below:
Assign local policies if required by your product. For Windows, the user ID typically requires
“Act as part of the OS, Bypass Traverse Checking, Log on as a batch job, and Log-on as a
service.”
So do I need to create a local admin account on the server or a domain admin user with above privileges assigned will work?
I am trying to insatlled epm 11.1.2.3 on windows 2008 R2
Thank you for the help

If you are installaing in single Server, Create a user with Administrative rights then go to Administrative tools --> Local security policies and give the
Act as part of the OS, Bypass Traverse Checking, Log on as a batch job, and Log-on as a service.”
Thanks,
Mady

Is it appropriate to apply the hardening settings for Windows 2008 R2 server to Windows 2008 server?

We would like to adopt the hardening recommendation for Windows 2008 R2 from CIS to all our DC servers. However, but then we found some of our DC in remote sites are Windows 2008 server only.
Is the hardening settings from Windows 2008 R2 from CIS also applicable to Windows 2008 DC?
Thanks for your attention.

Yes, this should be fine. Hardening only specific security settings, registry keys etc and there's not much difference if you consider hardening.
Just for reference, here's the difference between 2008 and R2 :
http://technet.microsoft.com/en-us/library/dd391932(WS.10).aspx
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Windows 2008 DNS & DHCP configuration steps for 11gR2 GI install with GNS

Hi,
I have windows 2008 R2 server with DNS & DHCP services installed. I am planning to install 2 node RAC with GNS option.
The problem is i could not find any document to setup the windows 2008 DNS server for the below steps.
a. Configure GNS VIP : add a name resolution entry in a DNS for the GNS virtual IP address in the forward Lookup file.
gns-server IN A <virtual_IP>
where gns-server is the GNS virtual IP address given during grid installation.
b. Configure the GNS sub-domain delegation: add an entry in the DNS to establish DNS Lookup that directs the DNS resolution of a GNS subdomain to the cluster.
clusterdomain.example.com. NS gns-server.example.com.
where clusterdomain.example.com is the GNS subdomain (provided during grid installation) that you
delegate and gns-server.clustername.com resolves to GNS virtual IP address.
I am aware that this configuration steps has to be taken care by the System administrator. Here is what he tried and the results.
My SA was able to Configure GNS VIP in the DNS and the Nslookup works fine for this.
When he Configures the GNS sub-domain delegation the nslookup fails when trying to resolve the SCAN name.
Any step by step tutorial for this windows 2008 DNS & DHCP configuration for Oracle GNS setup would be highly appreciated.
Thanks,
Ashok Kumar.G

Hi Guys,
Any help on this request will be very helpful.
Thanks,
Ashok Kumar.G

User having problem changing password on Windows 2008 R2 via remote desktop win7

I have a remote user in another building with OS 7 remote destkop to Windows 2008 R2 Server. The users account is set to change password on first login. when the users trys to change his pw he gets error "Configuration information could not be
read from domain controller, either because the machine is unavailable, or access has been denied.
We are not using domain controller on the Windows 2008 R2 Server it is set to workgroup.
Any help ASAP would be greatly appricated.
Thanks,
Rob Jung

Here is one of the event logs from when the user tried to logging (and change password on the first login):
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/13/2011 5:09:11 PM
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      win007.#***.net
Description:
An account failed to log on.
Subject:
Security ID:  SYSTEM
Account Name:  WIN9$
Account Domain:  ***
Logon ID:  0x3e7
Logon Type:   2
Account For Which Logon Failed:
Security ID:  NULL SID
Account Name:  Administrator
Account Domain:  WIN007
Failure Information:
Failure Reason:  Unknown user name or bad password.
Status:   0xc000006d
Sub Status:  0xc000006a
Process Information:
Caller Process ID: 0x254
Caller Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Workstation Name: WIN007
Source Network Address: 127.
Source Port:  0
Detailed Authentication Information:
Logon Process:  User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length:  0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{*******}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
Rob Jung ADRWeb

Move Computer Accounts from Computers container to OU

I created a global security group called "IT Support", and I'd like to grant this group the permission to:
1. Join computers to domain
2. Move newly created (or already existing) computer accounts from the Computer container to a specific OU and sub-OUs
3. Modify group memberships for computer accounts (new or existing)
I can't seem to get this right...can someone help me complete this task correctly?
Windows Server 2008 R2 (domain and forest level).
Users will be using RSAT for Win7 (x86).
Thank you!

I would like to start with a Wiki article that shows to delegate administration in Active Directory
Delegation of administration in Active Directory: http://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx
My answers to your questions are:
1.
Read that: http://social.technet.microsoft.com/Forums/windowsserver/en-US/1185fb93-913c-42e3-bcfc-dfbbba57a2bc/joining-a-computer-to-domain-by-delegating-to-domain-user?forum=winserversecurity
2.
Delegate moving user, group and computer accounts between Organizational Units in Active Directory: http://social.technet.microsoft.com/wiki/contents/articles/20747.delegate-moving-user-group-and-computer-accounts-between-organizational-units-in-active-directory.aspx
3. You can delegate that as a task on the target groups using Active Directory Delegation of Control Wizard:
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Windows 2008 R2 activation

Hello,
I'm trying to activate Windows 2008 R2 Standard on my computer and I get an error. I want to do the phone activation, but I do not get the phone numbers list (only a link to the help file), and I do not get the phone activation screen (with the fields for manual input). I looked for a number on the web but found only the volume license activation numbers. I have a standard license.
I live in Canada...does anybody know the number and how to get the phone activation screen?
Thanks.

This website lists all numbers you may need
http://www.microsoft.com/licensing/existing-customers/activation-centers.aspx
Isaac Oben MCITP:EA, MCSE

Does Windows 2008 Server run ok under Mac Mini Bootcamp?

Does anyone have any experience of installing and running Windows 2008 Server on a Mac Mini (of which has either Mac OS or Mac OS Server installed), under Bootcamp?
I currently have an old Dell with Windows 2008 server which acts as my Domain Controller, Exchange Server for a small home-office network. It's due an upgrade as the hardware is so old (and noisy!) and like the idea of having a nice compact, quiet Mac Mini, but want to make sure it can carry out the same duties under bootcamp on Win2008?

Windows 2008 can be installed in Boot Camp. However I don't believe it is officially supported by Apple so there may or may not be issues with installing the Boot Camp Drivers (or future updates to the Boot Camp drivers.) Not something I'd be recommending for a "production" environment. If this is a test/dev system, then probably worth trying, depending on how critical your network uptime is.
Also, you didn't mention if your Dell came with Windows 2008 preinstalled, but if it did, then likely it has a "branded" version of Windows that won't activate correctly on non-Dell hardware. (If your Windows disks have "Dell" on them, they won't work with the Mac.) So you may need to purchase a retail or volume license copy of Windows 2008.
In general, for a server running as a DC & Exchange, you'd want RAID1 as a minimum so that would be the Mac Mini Server, not the "desktop" Mac Mini. Unless you have one lying around, you're looking at something around $1500-$2000 to start, depending on whether you can transfer your existing Windows 2008 & Exchange installations. (Another $500-$2000 depending on what vesions of Windows & Exchange.) And probably 8GB of RAM since Windows 2008 & Exchange on 4GB is pushing it. Considering the costs, I suggest you look at the Dell T110 series or the HP Proliant 110 series. Both lines are very quiet and are supported for Windows 2008 from the factory, including Windows Small Business Server, which includes Exchange. While not as small as a Mac Mini, they are mini towers and about the size of a typical PC desktop.
If you really wanted a small footprint, then HP has a "microserver" series. You'd probably need to call HP to get the build you want as the online ordering is limited for that model. From Dell, there is the Zino model desktop. Again, not supported for a "server", but you were going to consider a the non-server version of the Mac Mini, then the Zino has at least a chance of you reusing your existing versions of Windows if they're Dell branded, thus saving your something in the range of $500-$2000 for new software. (But I would NOT recommend a non-server chassis without RAID1 hard drives, so the Zino is not my choice. I just offer it as a possibility if you accept the risk of an unsupported installation, as would have been installing Windows 2008 in Boot Camp.)
So yes, it will work. But I wouldn't recommend it for a production environment, especailly if you have the "desktop" computer without RAID1.

Duplicate SPN for user accounts

Hi Support,
I get an error on the system log like the below - but is bringing up a user account rather tham for a computer account; for duplicate SPN:
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is username. (of type -17). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate
entries for username in Active Directory.
Steps in the article KB321044 is for computer accounts and not for user accounts; is there any relevant steps for user accounts having duplicate SPNS ?
Thanks,
Arun

I've followed the above steps and does not seem to resolve my issue and the below error on system log repeats:
Log Name: System
Source: Microsoft-Windows-Kerberos-Key-Distribution-Center
Date: 20/08/2014 10:29:49
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: xxxxxxx.xxxxxxx.internal
Description:
The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is [email protected] (of type -17). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate entries for [email protected] in Active Directory.
* Setspn -x command on Server does not list any duplicate SPNs
* Followed http://support.microsoft.com/kb/321044 , but output does not give any duplicate SPNs
* Referred this article and SPN shows only one value and no duplicates:
http://blogs.technet.com/b/qzaidi/archive/2010/10/12/quickly-explained-service-principal-name-registration-duplication.aspx
* Tried re-registering SPN for the account sphilpot as per this article - which :
http://msdn.microsoft.com/en-IN/library/ms191153.aspx#Manual
Not sure this will fix the issue.
{ Noticed Disk error on System event log noticed: " The driver detected a controller error on
\Device\Harddisk1\DR1 "
For which asked to remove/format the Expansion S drive and test }

How to install BI Publisher 10.1.3.4.2 on Windows 2008 R2

Hi experts
Refering to the document
Oracle® Business Intelligence Publisher
Certification Information
10g Release 3 (10.1.3.4.2)
E12692-08
To install on Windows 2008 R2　follow the steps in "Manually Installing BI Publisher to a J2EE Application Server" in the Oracle Business Intelligence Publisher Installation Guide.
Now CT's BIP Apps server is standalone OC4J, In this case how to install BI Publisher 10.1.3.4.2 on Windows 2008 R2
Looking forward for your reply
Regards
shuangfei

Two steps:
1. Install the repository
2. Install the BIP application on OC4J
It is clearly explained here:
http://docs.oracle.com/cd/E12844_01/doc/bip.1013/e12690/T434820T487783.htm#xdosa_maninstall
regards
Jorge
p.s Is this answers your question then please mark it as "Correct" or "Helpful"

Windows 2008 R2 AD auth for computer account

Similar Messages

Maybe you are looking for