SBS 2k3 and XP domain auth

[LoOnY911]

Hey guys,

Weird problem.

So I have a very simple network with a domain running on sbs 2003 with all xp users. They all have no problems logging in whatsoever.

One user, who happens to be my boss, has intermittent issues with logging in. It usually happens after leaving his computer idle for a while. It will auto lock after x minutes and when he tries to log in, it gives him an error saying the his account has been locked. It even says the administrator account has been locked (every account is locked). It will give you a password error if you put in the wrong password. I think it only happens when he is wireless, too.

I found a weird fix where if you disable the wireless (with a hard switch on the outside of the laptop), re-enable it until it connects and then disable it again, you can unlock the computer with no problems. If you try to log in in the middle of that weird fix (like after the wireless connects), it won't work and you will have to repeat my weird fix.

I looked through event viewer and I couldn't find anything about denying access but I found a couple errors:

Event Type: Warning

Event Source: LSASRV

Event Category: SPNEGO (Negotiator)

Event ID: 40961

Date: 4/3/2009

Time: 7:56:38 AM

User: N/A

Computer: GSM004

Description:

The Security System could not establish a secured connection with the server DNS/gsmsbs.gsmsystems.net. No authentication protocol was available.

Event Type: Warning

Event Source: W32Time

Event Category: None

Event ID: 18

Date: 4/3/2009

Time: 8:13:48 AM

User: N/A

Computer: GSM004

Description:

The time provider NtpClient failed to establish a trust relationship between this computer and the gsmsystems.net domain in order to securely synchronize time. NtpClient will try again in 15 minutes. The error was: The trust relationship between this workstation and the primary domain failed. (0x800706FD)

Event Type: Warning

Event Source: Tcpip

Event Category: None

Event ID: 4226

Date: 4/3/2009

Time: 8:17:06 AM

User: N/A

Computer: GSM004

Description:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.



Any thoughts? Let me know if you need any further information.

 

[Mr_Unlucky]

First off, windows caches login credentials (so you can login on your laptop when you're not online), so that's why it works when you are D/Ced from the wireless.

first, enable auditing logging for people logging in/failed logins.

Also, if the time is not synced with the server, windows will not auth. This variable is diff in 2000 and XP, but you can change it with Group Policy, if i remember correctly.

However, that's probably not the problem. the problem is the trust relationship. SBS has a network security thingy that basically authenticates every PC, giving it basically a trusted key for authing. The computer auths every time it boots, just as the user. There are a few different types of auth protocols it can use (just like IIS can use different ways to login to exhange web mail).

First steps would be to check firewalls to make sure the PC isn't restricting communication. Then re-add the pc to the domain, then re-create the user (and re-home the exchange mailbox, etc).

 

[-=TTC=-Serpreme]

Disabled the power management on the devices, maybe it disconnects, and dirty reconnects once you force it.

 

[Vlasic]

You need to do more troubleshooting.

You need to determine if it indeed only happens through wireless. If so, you may have a driver issue. Also, disable power management like serpreme says.

You also need to determine if he actually has access to network resources when the thing does "log in." If so, then it's not going to be a trust or computer account issue.

Also, time synch is important.

Does it work properly on a wired connection?

 

[Snake~eyes]

Disabled the power management on the devices, maybe it disconnects, and dirty reconnects once you force it.

I am leaning towards this at the moment, this was my first intuition.