none
Windows 7 Offline Files Issue - The system has detected a possible attempt to compromise security. RRS feed

  • Question

  • I have looked through all the similar threads but still couldn't find a solution to this.  We have Windows 7 machines logging into a Windows 2008 AD networks. While on the network, our clients are set to use internal DNS set by DHCP. A few of our folks have offline files setup on their home drives.  These users can successfully log onto their computers offline.  When they attempt to access their offline files however, they receive the message "The system has detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you" along with the option to provide their credentials. Entering their credentials fails of course. The work around for them is to disconnect from the wireless network or disable the WLAN card. At that point they can access their offline files.  But as soon as they reboot, they receive the same message.  If they reboot with the WLAN card disabled, they will not receive this message and are able to access their offline files.  Additionally these users are setup with VPN. If they enable VPN, the issue is corrected and they can again access their offline files.

    We've attempted removing and rejoining to AD, removing their user profiles and completely rebuilding the laptop from scratch. It appears when the laptop is connected to a wireless network, it wants to contact our AD network. The articles below haven't offered a solution.  

    http://support.microsoft.com/kb/938457

    http://support.microsoft.com/kb/172931
    Wednesday, May 18, 2016 4:57 PM

All replies

  • Hi Chris Cerami,

    Are there any related error messages recorded in the Event Viewer(Windows Logs\Application, System)? Did the issue occur with all the machines or the specific one? Is the issue resolved by rebuilding and rejoining domain?

    Though the KB 938457 didn`t resolve the issue. It indicates there is a "kerberos" authentication failure at least.

    I noticed the issue only occurred when we used wireless. Have you configured specific policies for wireless network such as "802.1X" authentication? Have you tried to disable the firewall and the antivirus to have a troubleshoot?

    Best regards


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Thursday, May 19, 2016 3:19 AM
    Moderator
  • No other odd event logs. The issue is only manifesting itself with folks that use offline files. KB938457 doesn't appear to apply.  They are able to access all resources when on the network or with a VPN session enabled.  Disabling the firewall and antivirus hasn't had any positive effect.  The only workaround thus far is either disconnecting from the wireless network or disabling WiFi all together.  At that point they can reconnect/reenable and they are able to access offline files without any issues/errors until they reboot their machines.  It's like the machines are trying to connect to the file server even though they are off the network.  Very odd issue.  Thanks in advance.
    Thursday, June 2, 2016 1:12 PM
  • Hi Chris,

    Try the following command line to reset the tcp/ip stack to have a test.
    ipconfig /flushdns (Clear the dns cache)
    nbtstat -RR (release and refesh NetBIOS names)
    netsh int ip reset (reset ip settings)
    netsh winsock reset (Reset Winsock Catalog)
    Reboot

    Best regards


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, June 3, 2016 6:36 AM
    Moderator
  • I have already tried flushing DNS, resetting Winsock and the TCP/IP stack.  Thanks for the suggestions though.
    Tuesday, June 7, 2016 5:56 PM
  • Hi Chris,

    Have you configured specific policies for wireless network such as "802.1X" authentication(check the wireless network properties)?

    Best regards


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com


    Wednesday, June 8, 2016 3:01 AM
    Moderator