locked
NTLM authentication failed because the account was a member of the Protected User group. RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi everyone,

    we have two domains (A and B), each has its own forest and two domain controllers. There is a trust between domains. Each admin has two Domain Admins account in each domain (like A\Admin and B\Admin).

    Domain A has a PAW, where the admins are logging on with A\Admin and managing both domains (A\Admin was delegated some rights in domain B). But sometimes the admins have to connect (via RDP) to some server in B domain using B\Admin account. If an admin connects from his own computer (Windows 10) - it fails because of NTLM authentication, which is not allowed for the members of the Protected Users group. Then the admins connect from PAW and it works. In the logs I see another type of the Authentication - Kerberos!

    Question: how to enable Kerberos authentication on Windows 10 to be able to connect to a server in another Domain using credentials of this domain?

    Thank you in advance!

    Wednesday, June 17, 2020 8:57 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello,

    Thank you for posting in our TechNet forum.

    Hope the below article in the link might be helpful. 
    https://docs.microsoft.com/en-us/windows/win32/winrm/authentication-for-remote-connections

    For any question, please feel free to contact us.


    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, June 18, 2020 2:06 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Hannah,

    Unfortunately this link is not about my case. Mostly I have an issue with RDP connection. 

    Thursday, June 18, 2020 2:24 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hi,

    Thank you so much for your feedback.

    We are so sorry that the provided information is not about our case. Based on my research, In terms of the event 100: NTLM authentication failed because the account was a member of the Protected User group,

    “Accounts that are members of the Protected Users group that authenticate to a Windows Server 2012 R2 domain are unable to: Authenticate with NTLM authentication.”

    "If the domain functional level is Windows Server 2012 R2, members of the group can no longer use Data Encryption Standard (DES) or RC4 cipher suites in Kerberos pre-authentication" and " Members of the protected Users group must be able to authenticate by using Kerberos with Advanced Encryption Standards (AES)."

    For more information, we could refer to:
     
    Protected Users Security Group
    https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group#BKMK_HowItWorks

    Ten things you need to be aware of before using the Protected Users Group
    https://dirteam.com/sander/2014/11/25/ten-things-you-need-to-be-aware-of-before-using-the-protected-users-group/

    Protected User Group - Event ID:100 - NTLM Authentication failed
    https://social.technet.microsoft.com/Forums/en-US/5eec3347-d358-4078-85ed-021540ad0bd0/protected-user-group-event-id100-ntlm-authentication-failed?forum=winserversecurity

    Thank you so much for your support.

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.



    Thursday, June 18, 2020 8:45 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    I've seen all these links, but I didn't find information, how to force a user to use Kerberos instead of NTLM.
    Why a user uses NTLM from one host and Kerberos from another host?
    Thursday, June 18, 2020 9:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello,

    Thank you so much for your kindly reply.

    Based on my experience, when we access the shared directories via \\IP address on the domain joined server, the NTLM authentication will be used. While if via \\server name, the Kerberos authentication will be used. 

    According to my research, to force to use Kerberos instead of NTLM, we could try to disable NTLM. But something should be paid attention to, such as we need to figure out which applications use NTLM and it could not access the shared directories if the NTLM is disabled as far as I know.

    For more information, we could refer to: 

    https://social.technet.microsoft.com/Forums/windows/en-US/c5b18eba-454a-4e23-a87a-0872d526697d/disable-ntlm?forum=winserverNIS

    http://woshub.com/disable-ntlm-authentication-windows/#:~:text=You%20can%20also%20disable%20NTLMv1,Refuse%20LM%20NTLM%E2%80%9D.

    Thank you so much for your support.

    Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 19, 2020 7:48 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Hannah,

    I've set "Send NTLMv2 response only. Refuse LM & NTLM" on my computer:

    but I still can't connect and in the logs I see the same error:

    Friday, June 19, 2020 11:02 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hi Anahaym,

    Thank you so much for your kindly reply.

    As for "Question: how to enable Kerberos authentication on Windows 10 to be able to connect to a server in another Domain using credentials of this domain?"

    How we connect to a server in another domain? We are wondering whether we use the Remote Desktop Connection or \\IP address or server name\shared directories. 




    As for "If an admin connects from his own computer (Windows 10) ", we thought that Windows 10 is domain joined and we log on Windows 10 with domain administrator account? How could an admin connect from his own computer?

    I did some tests in my lab and tried to figure out this issue. But I could not reproduce our issue. I will keep on follow up this issue. For any update, I will come back to you.

    Thank you so much for your time and support.


    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 22, 2020 9:46 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Please let me explain again.

    You have the following accounts in two domains:

    contoso\hannah.xiong - non-domain user
    contoso\h.x - domain admin in Contoso
    fabrikam\h.x - domain admin in Fabrikam

    You have a contoso computer with Windows 10 there you log in as contoso\hannah.xiong.
    From Windows 10 computer you can log in via RDP to a server in contoso domain: PAW

    Now you want to connect via RDP to a domain controller in Fabrikam using fabrikam\h.x account. If you try to connect from Windows 10 - it fails. If you try to connect from PAW - you log in.

    I hope I've described it better.

    Monday, June 22, 2020 11:35 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello Anahaym,

    Thank you so much for the detailed explanation. I appreciate your time and support.

    I did more tests in my lab and the issue could not be reproduced. Below are my tests. 

    1, I logged on Windows 10 with the non-domain user (in my case, it is hannah), which is added to the protected group. From the Windows 10 computer (In my case, it is WIN1010), it connected to a server (In my case, it is DC) in contoso (In my case, it is book.com) domain via RDP.

    I tried to enter the wrong password and then I checked the event log as shown below. And then entered the right password, it could successfully log in. 



    2, I logged on Windows 10 with the non-domain user (in my case, it is hannah), which is added to the protected group. From the Windows 10 computer (In my case, it is WIN1010), it connected to a DC in Fabrikam (In my case, it is sayms.local) domain via RDP.

    I tried to enter the wrong password and then I checked the event log as shown below. And then entered the right password, it could successfully log in. 



    3, I tried to connect to a DC in Fabrikam (In my case, it is sayms.local) domain via RDP from the DC in book.com. I tried to enter the wrong password and then I checked the event log as shown below. And then entered the right password, it could successfully log in.



    From my tests, they could successfully log in if providing the right credentials. As for our case, it fails because of NTLM authentication, which is not allowed for the members of the Protected Users group.

    We are wondering whether it is the error message showing on the UI interface. Or when we enter the credentials, what is the error message on the UI interface? 

    For any question, please feel free to contact us.


    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, June 23, 2020 10:11 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    sorry, my bug mistake.... I apologize... 🙏

    1, I logged on Windows 10 with the non-domain user (in my case, it is hannah), which is added to the protected group

    the user is domain, I meant non-admin user... and this user ins't member of Protected Users group.

    So, the procedure is the following:

    book\hannah logs in to WIN1010
    sayms\hannah tries to connect to DC in sayms domain via RDP
    sayms\hannah is a member of Protected Users group

    Please don't use built-in Administrator.

    When it fails to log in, I see this:

    and on DC this:

    Tuesday, June 23, 2020 11:12 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello,

    It's OK. Thank you so much for your kindly reply.

    Below is my test. 

    1, Log on the Windows 10 with BOOK\susan and this user is not member of protected group. 

    2, Then Remote Desktop connect to DC in SAYMS domain with SAYMS\emma, which is a member of Protected group. 






    3, In my test, I entered the wrong passwords and then checked the event viewer as shown below. It could successfully log on when entering the right password.  



    As for this error message, it seems to be a Remote Desktop Connection issue. Have we entered the password of the user account when connecting to the DC in another domain via RDP? 

    I researched and found out that we might get this error message when using a user account without password. For more information, we could refer to: https://social.technet.microsoft.com/Forums/office/en-US/832a70f9-f829-4bb4-b6d6-b2409f17b23f/rdp-remote-desktop-to-windows-10-without-passwords-not-possible-anymore-bug-or-feature?forum=winserverTS

    Thank you so much for your time and support.

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 24, 2020 9:20 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello Hannah Xiong,

    yes, of course I'm entering the password.
    I see, that you have other logon process (User32) and authentication package (Negotiate). What is version of you Domain Controller? What is the domain functional level?

    Wednesday, June 24, 2020 9:50 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello Anahaym,

    Thank you so much for your feedback.

    It is Windows Server 2008 R2 DC with the domain and forest functional level Windows Server 2008 R2. 


    For any question, please feel free to contact us.

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 29, 2020 6:12 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello Hannah,

    the Protection Users group is available with Windows Server 2012 R2.

    Protected Users group requirements

    Requirements to provide device protections for members of the Protected Users group include:

    • The Protected Users global security group is replicated to all domain controllers in the account domain.

    • Windows 8.1 and Windows Server 2012 R2 added support by default. Microsoft Security Advisory 2871997 adds support to Windows 7, Windows Server 2008 R2 and Windows Server 2012.

    Requirements to provide domain controller protection for members of the Protected Users group include:

    • Users must be in domains which are Windows Server 2012 R2 or higher domain functional level.


    • Edited by Anahaym Monday, June 29, 2020 10:45 AM
    Monday, June 29, 2020 10:43 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello Anahaym,

    I would appreciate your kindly feedback. So sorry for the inconvenience caused. Thank you so much for your correction. 

    I did the test again and below are the steps. 

    1, Log on the Windows 7 with SAYMS\emma and this user is not member of protected group. 

    2, Then Remote Desktop connect to DC in BOOK.com domain with BOOK\mytest, which is a member of Protected group. 





    3, The DC in BOOK.com is Windows 2016 with DFL/FFL Windows 2016.



    4, In my test, I entered the wrong password and then checked the event viewer as shown below. It could successfully log on when entering the right password.  






    For any question, please feel free to contact us.


    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, June 30, 2020 8:01 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello Hannah,

    Thank you for your test.

    Which message do you see, when you successfully logged in BOOK\DC$ with BOOK\mytest?

    In your picture I see, the mytest is a member of Domain Admins, but not Protected users.

    Tuesday, June 30, 2020 9:42 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello Anahaym,

    You are welcome and thank you so much for your feedback.

    I added BOOK\mytest to Protected User group. 


    When I logged in BOOK\DC$ with BOOK\mytest account, it could be successful, but I did not see any message. And I also did the same test as before, it could also successfully connect via Remote Desktop Connection. Once I entered the wrong password, the event viewer recorded the below events. 




    Thank you again and have a nice day.

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, July 1, 2020 10:03 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    could you please check Event ID 4624 on the DC?

    Wednesday, July 1, 2020 10:33 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hello,

    Thank you so much for your kindly reply.

    Below is the Event ID 4624 on DC. 




    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, July 2, 2020 5:15 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Hannah,

    it is very strange. You have logon type 10, that is absolutely correct, but I have logon type 3... maybe my problem isn't related to RDP at all...

    Thursday, July 2, 2020 7:15 AM
  • Question
    Sign in to vote
    1
    Sign in to vote
    Hi Anahaym,

    Thank you so much for your feedback.

    It is suggested that we could use the Network Monitor to capture the network package for further troubleshoot. Due to security consideration, we do not analyze the network package here. 

    Thank you so much for your understanding. 

    Best regards,
    Hannah Xiong

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, July 3, 2020 10:39 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Unfortunately, we are still facing this issue.
    I can connect to servers in second domain only from DCs in first domain...
    Monday, July 20, 2020 9:45 AM