MSLogon II and Local Users/Group rejected

[Lucent]

Hello,
I have mslogon II configured with domain groups and local users/groups.
Domain users are validated correctly but local users not, authentication rejected.

Has anyone configured mslogon II with local users or groups?

[Rudi De Vos]

Old info but it could still be the case in newer OS's


ForceGuest registry value is set to 1 by default in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
If the Guest account is enabled, an SSPI logon will succeed as Guest for any user credentials.
If ForceGuest is disabled (set to 0), SSPI will log on as the specified user.
So it's important to disable ForceGuest. Otherwise all authorization is done against the guest account!
Policy Settings: Authentication will fail if "Deny logon to the computer from the network" is enabled for a group the logon account is a member of. This applies to both Local Policy Settings as well as Group Policy Objects.
So make sure user accounts used for MS Logon authentication are not affected by these settings.