Kerberos logon failure - Windows Server 2003 RTM

From: Henrik Andersson (henrikanderzon_at_hotmail.com)
Date: 05/13/03

Next message: Dale B: "Port filtering, Help!"
Previous message: Ed: "Re: Share is denied and user is locked out"
Next in thread: JK [MSFT]: "Re: Kerberos logon failure - Windows Server 2003 RTM"
Reply: JK [MSFT]: "Re: Kerberos logon failure - Windows Server 2003 RTM"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: 13 May 2003 05:33:44 -0700

I am really stuck and need some help with my delegation/logon problem.
I start with a short brief of the web site architecture:

Domain controller with Windows 2003 RTM.
Authentication server (DEMOAUT01) with Windows Server 2003 RTM (Proxy
filter functionality).
Application server (DEMOAPP01) with Windows Server 2003 RTM (Websites
are placed here).
Database server with Windows 2000 Advanced Server.

Users logon to the web site from the authentication server and are
then redirected to the application server where the websites are
placed. I have configured AD on the domain controller so that a
service user is privelige to act as part of the operating system. The
proxy web on the authentication server is run under the identity of
the service user (UserImp). Impersonation configuration has been done
both on the authentication server and on the application server with
read/write acces to specific folders and configuartion of
machine.config. The logon code is written in C# (WindowsIdentity).
Activedsnet.dll and a wrapper class to this is used (constructed on
.NET Server RC1).

To access the anonymous part of the website with a preconfigured
anonymous user account is no problem. There is also no problem to
create a user from the web site (the wrapper class is used here). When
this is done a new user is created in the AD and is placed in the
right user groups etc.

The problem comes when I try to logon with the created user. Below is
an extract of the security log on the authentication server. I get
Failure audit with event id 537. Explaination From msdn: (Logon
failure. The logon attempt failed for other reasons.Note: In some
cases, the reason for the logon failure may not be known., from
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/server/518.asp).

I would really appreciate if some of you have any ideas about this. A
collegue of mine have previously done this on .NET Server RC1 but has
not experienced the same problems. Are there any changes to the
delegation functionality in Windows Server 2003 compared to RC1 or
what can be the problem? Please see the logs below.

Thanks

1-------------------------------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 552
Date: 5/13/2003
Time: 12:14:42 PM
User: DEMO\UserImp
Computer: DEMOAUT01
Description:
Logon attempt using explicit credentials:
Logged on user:
         User Name: UserImp
         Domain: DEMO
         Logon ID: (0x0,0x16264E)
         Logon GUID: {69fe1294-2037-b4aa-1709-41f8643b6282}
User whose credentials were used:
         Target User Name: henrik
         Target Domain: demo
         Target Logon GUID: {4b1e35cd-26ee-03d3-c7a2-22510228b08f}

Target Server Name: localhost
Target Server Info: localhost
Caller Process ID: 1912
Source Network Address: -
Source Port: -