UltraVNC

With ms-logon II, you have just one Windows logon per VNC connection attempt.
In MS parlance, it's a network logon.
ms-logon I sometime uses several Windows logons, depending on the configuration.

Why do you want to change the acl all the time?
maybe there's a more elegant way to solve your problem.

BTW, if you open the registry, your users can change the settings, too.
Probably not what you intended.

with mslogon II, you can can authorize individual users.
So just add the computer owner's account to MS-Logon II.
Obviously this is a per machine setting.

turbokitty,

If you use ms-logon, the VNC "classic" password will never be really used.
But there's a check when the VNC server starts if the password is set.
This check is performed always, even with ms-logon. (Seems to be for historical reasons)

So it should be sufficient to have anything set for ...

this is not directly a UltraVNC question, more a general MS Windows question.
I can imagine that you can do something like that with e.g. RSA token (formerly SecureID).
Regarding mslogon, at least with mslogon II it should be possible to use such onetime passwords.
Mslogon II is doing just one ...

i don't think so.
But I'm also not aware of the USB key remote desktop method...

already tried MS-Logon II?
Do you have the same behavior there?

Maybe there are two accounts with the same name (User A), one in the domain, one on the machine (client B)?
I.e. Domain\User A and Computer\User A.

Hans-Georg,

Just for testing: Could you please switch to "classic" password.
I'm not sure if the issue you have is MSLogon specific or if it's independent of the authentication method.

Martin

you can completely disable the Admin properties page.

Could you provide more information?
Version of UltraVNC?
Which OS?
Look into the EventLog and search for UltraVNC entries.

When you check "Require MS Logon" and "New MS Logon", you also have to "Configure MS Logon Groups".
There you can add the accounts or groups you want to give VNC access.

You don't need admin rights for connecting with MSLogon I.
With MSLogon I, you just have to enter the username without any domain prepended/appended.
MSLogon I then searches if there is a local user with that name or a domain user with that name.
The domain that is searched is the one where the ...

If you cannot connect via VNC to the IP address but can ping to the IP address, either the vnc server is not running or it is configured to be running on a different port.

Not sure if this is an authentication problem or just an issue with connecting:
In the viewer, either specify the fully qualified name of the other computer, e.g. mycomp.mydomain.com, or use the IP address.
If you can connect but not authenticate, please prepend the domain to the username, e.g ...

Is your AD in native mode?
Is your MSLogonII group a global or domain local group?
Is the protection group you want to add a global or domain local group?

Group nesting requires native mode.
You can nest
- domain local groups in domain local groups
- global groups in global groups
- global groups ...

there's no answer to the WHY.
Maybe it's historical because in the beginning VNC only knew the "classic" authentication.
When MSLogon was added, nobody removed the requirement for the "classic" password.

If you want to use an account from another domain (with MSLogon II), you have to specify DOMAIN ...

my guess is that there is a local account "shawn" on this computer.
If you do not specify a domain, Windows starts looking for
- a local account on the machine,
- then for an account in the domain the computer is joined to,
- then perhaps for an account in other domains in the AD

MSLogon II does this.
You just have to configure a group or account from the other domain to be authorized.

with UltraVNC you have just 1 sessions.
Even if you allow several simultaneous connections they all share the same session (seeing the same desktop).

MSLogonACL has to write to HKLM\Software\UltraVNC.
This normally requires admin rights...
Adding UltraVNC as a service also requires admin rights.
That's windows.

MS-Logon II in 1.0.2 is not backwards compatible due to security concerns.
The 1.0.2 viewer still understands the older MS-Logon II.
All MS-Logon versions are UltraVNC-only.

If your single DC is down, then not only the MIS guys but also the users cannot log in, so there is a bigger problem.

You can create a local account on each machine and configure this in addition in UltraVNC.
Then have a policy for your supporters that they can use this account as a fallback if the ...

have not checked the 1.0.2 Setup, but it's definitely in UltraVNC-102-Bin.zip

hmm, maybe it's already implemented...
With MS-Logon (I or II), you don't need a domain account, you can also just use a local computer account for authentication.
So you need to create enough accounts for your users on your machine and configure UltraVNC to use that for authorization.

sorry, this is not possible with MS-Logon II.
I'm not aware of any other tool that could handle this.
It's not part of the underlying NTLM protocol.

this sounds like you're using MS-Logon I.
With MS-Logon II, one VNC logon attempt corresponds to just one Windows logon attempt.
To enable MS-Logon II, check both "Require MS Logon" and "New MS Logon".

It would be helpful to add a customizable text area to the query dialog.
This could be used to show some legal notice to the user before (s)he accepts the connection.

My guess is you are using a 1.0.1 viewer (or older) and try to connect to a 1.0.2 server.
With UltraVNC 1.0.2, the authentication protocol for MS-Logon (both I and II) changed.
So older viewers are not able to connect.
This is a documented change due to security issues.

MS-Logon II is definitely checking the groups.
It's the same mechanism that is used for accessing shares etc.
Create a share on the computer and set access rights to the same groups/users as in MS-Logon II.
Then do a 'net use' from another machine with the same credentials.
If you can access the ...