Cross Forest authentication issue Event ID 4625 and Netlogon logs
i have 3 forests, forest forest b , forest c.
forest c new, users in forest have never been able authenticate.
forest c has 1 way non transitive trust domain in forest b
forest c has 1 way transitive forest trust forest a.
time sync'd between forests, trusts have been validated, sids enumerating on objects can viewed in domain local groups , foreign security principals.
users in forest have been permissioned on devices in forest c
users in forest b have been permissioned on devices in forest c
users in forest b can authenticate resources in forest c, users in forest generate below error when attempting access same resources. in case rdp session attempting initialized.
an account failed log on.
subject:
security id: system
account name: computer.in.forest.c$
account domain: domain.in.forest.c
logon id: 0x3e7
logon type: 10
account logon failed:
security id: null sid
account name: userinforesta
account domain: domain.in.forest.a
failure information:
failure reason: an error occured during logon.
status: 0xc000018b
sub status: 0x0
process information:
caller process id: 0xb0
caller process name: c:\windows\system32\winlogon.exe
network information:
workstation name: serverinforestcwhereresourcesarepermissioned
source network address: 10.10.10.10
source port: 0
detailed authentication information:
logon process: user32
authentication package: negotiate
transited services: -
package name (ntlm only): -
key length: 0
net logon logging turned up, results log below. didn't see glaring in there.
07/17 13:16:50 [logon] [544] samlogon: network logon of domaininforesta\userinforesta computerinforesta entered
07/17 13:16:50 [logon] [544] samlogon: network logon of domaininforesta\userinforesta computerinforesta returns 0x0
07/17 13:16:52 [logon] [544] samlogon: network logon of domaininforesta\userinforesta computerinforesta entered
07/17 13:16:52 [logon] [544] samlogon: network logon of domaininforesta\userinforesta computerinforesta returns 0x0
07/17 13:16:54 [misc] [544] dsgetdcname function called: client pid=1576, dom:domaininforesta acct:(null) flags: ret_dns
07/17 13:16:54 [misc] [544] netpdcinitializecontext: dsgetdc_valid_flags c03ffff1
07/17 13:16:54 [misc] [544] netpdcgetname: domaininforesta using cached information ( nldccacheentry = 0x000000ab4aa546f0 )
07/17 13:16:54 [misc] [544] dsgetdcname: results follows: dcname:\\dcinforesta.domaininforesta dcaddress:\\ipv6addressdcaddrtype:0x1 domainname:domaininforesta dnsforestname:foresta flags:0xe00031fc dcsitename:nameofdcsite clientsitename:nameofclientsite
07/17 13:16:54 [misc] [544] dsgetdcname function returns 0 (client pid=1576): dom:domaininforesta acct:(null) flags: ret_dns
07/17 13:16:54 [misc] [2556] dsgetdcname function called: client pid=4, dom:domaininforestc.some.domain.path acct:(null) flags: ip kdc
07/17 13:16:54 [misc] [2556] netpdcinitializecontext: dsgetdc_valid_flags c03ffff1
07/17 13:16:54 [misc] [2556] netpdcgetname: domaininforestc.some.domain.path cache old. 8224062
07/17 13:16:54 [mailslot] [2556] netpdcpinglistip: domaininforestc.some.domain.path: sent udp ping ipv6address
07/17 13:16:54 [misc] [2556] nlpingdcnamewithcontext: sent 1/1 ldap pings dcinforestc.domaininforestc..some.domain.path
07/17 13:16:54 [misc] [2556] netpdcallocatecacheentry: new entry 0x000000ab4ab36260 -> dc:dcinforestc dnsdomname:domaininforestc..some.domain.path flags:0x73fd
07/17 13:16:54 [misc] [2556] nlpingdcnamewithcontext: dcinforestc.domaininforestc..some.domain.path responded on ip.
07/17 13:16:54 [misc] [2556] netpdcgetname: domaininforestc..some.domain.path using cached information ( nldccacheentry = 0x000000ab4ab36260 )
07/17 13:16:54 [misc] [2556] netpdcderefcacheentry: destroying entry 0x000000ab4ab426a0
07/17 13:16:54 [misc] [2556] dsgetdcname: results follows: dcname:\\dcinforestc.domaininforestc..some.domain.path dcaddress:\\ipv6address dcaddrtype:0x1 domainname:domaininforestc.some.domain.path dnsforestname:domaininforestc.some.domain.path flags:0xe00073fd dcsitename:default-first-site-name clientsitename:default-first-site-name
07/17 13:16:54 [misc] [2556] dsgetdcname function returns 0 (client pid=4): dom:domaininforestc.some.domain.path acct:(null) flags: ip kdc
07/17 13:16:54 [session] [1200] i_netlogongetauthdata called: (null) domaininforestc (flags 0x1)
hi,
thanks response.
please have @ this:
accessing resources across forests
http://technet.microsoft.com/en-us/library/cc772808(v=ws.10).aspx
cross-forest kerberos authentication delegation of client credentials
similar thread has been discussed:
cross-forest authentication failure
regards.
if have feedback on our support, please click here
vivian wang
technet community support
Windows Server > Directory Services
Comments
Post a Comment