Re: windows authentication uses guest

From: Roger Miller (rogerm_at_gasullivan.com)
Date: 06/26/03 

Date: Thu, 26 Jun 2003 15:43:23 -0500

Yes, I did. I just disabled it and now I got "401: access denied".

Thanks that solved my problem!!!!!!!!!!!!!! I guess that's in the standard
security handbook to disable guest.

 But I'm a little bit disturbed that the authentication mechanism
automatically rolled over to use a guest account. Could you explain why
that is (if you have time or understand the reasoning)?

Thanks again!
Roger

"Matjaz Ladava" <matjaz@_nospam_ladava.com> wrote in message
news:eD4zXJCPDHA.3088@TK2MSFTNGP10.phx.gbl...
> Do you have your guest account enabled on the server ?
>
> --
> Regards
>
> Matjaz Ladava, MCSE (NT4 & 2000)
> matjaz@ladava.com
> http://ladava.com
>
> "Roger Miller" <rogerm@gasullivan.com> wrote in message
> news:uO5OFwBPDHA.2788@TK2MSFTNGP10.phx.gbl...
> > My problem is I can't get authentication to fail like I think it should.
> >
> > I've got a fat client using web services on Windows 2000. Initially to
> > access the web services, we attempt to use the default credentials. If
> this
> > fails (we have some cross domain scenarios), we prompt the user to
provide
> a
> > username/password. We set the web references credentials to a new
> > credential object we create, and (if successful) use these credentials
for
> > all future access.
> >
> > My problem is this...when I supply bogus credentials, its not failing
> > authentication. I have anonymous off in IIS (for this virtual
directory)
> > and integrated windows authentication on; also my web config sets
windows
> > authentication; so I expect a 401: Access denied error.
> >
> > Instead it apparently works and goes into my
> > windowsAuthentication_onAuthenticate method in the global.asax. Looking
> at
> > the user there, the identity is "servername\guest".
> >
> > There are a few strange circumstances.
> > 1) I'm in development, so both my client and web service are sitting on
> the
> > same box.
> > 2) As such, I'm running in a single domain.
> > 3) Since I would authenticate, I've commented out the lines (client
side)
> > that try to authenticate with the default user and go straight into my
> > exception code.
> > 4) The other odd thing is that if I supply a valid user credentials, the
> > identity is correct; If I supply one with bogus domain, I get the
"Access
> > Denied" error I expect.
> >
> > It could be a testing artifact, but it makes me very nervous. Any
> thoughts
> > on whats wrong and why I get the servername\guest as the identity.
> >
> > Thanks,
> > Roger
> >
> >
> >
>
>

Relevant Pages

  • Re: SBS 2003 server sharing a folder to a non authenticated user or device (can it be done?)
    ... Plus exchange and SQL do consume quite a bit of non-paged pool and this has the effect of making the server cough occasionally, you only see this at high IO times. ... What you MUST be aware of the the whapping security hole the guest account will drive into your network. ... Someone must have done an impact analysis for enabling the guest account on a default SBS install.. ... authentication and will use Exchange ...
    (microsoft.public.windows.server.sbs)
  • Re: Wits End with Networking
    ... If you are using Guest authentication, then is the Guest account on each ... If you are using classic authentication, ... on each of the computers? ... "net use" creates a drive letter for a remote sharable folder. ...
    (microsoft.public.windowsxp.network_web)
  • Re: "Identical" accounts on networked computers
    ... You can only access the computer with a valid username and the ... will attempt a second authentication through the Guest account, ... On Windows XP Home or on XP Pro ...
    (microsoft.public.windowsxp.network_web)
  • Re: Connect via workgroup
    ... authentication is done using the ... guest account as simple file sharing is always enabled on XP ... I do not know why it is using Guest instead of the User ID that I specified. ... I also activated the Guest account in XP for both machines. ...
    (microsoft.public.sqlserver.connect)
  • Re: Login failed for ServerGuest
    ... You can enable the guest account but that's a security risk ... For SQL ... although Windows Authentication is more secure than ...
    (microsoft.public.sqlserver.connect)