Hello,
I have mslogon II configured with domain groups and local users/groups.
Domain users are validated correctly but local users not, authentication rejected.
Has anyone configured mslogon II with local users or groups?
Update: UltraVNC 1.4.3.6 and UltraVNC SC 1.4.3.6: https://forum.uvnc.com/viewtopic.php?t=37885
Important: Please update to latest version before to create a reply, a topic or an issue: https://forum.uvnc.com/viewtopic.php?t=37864
Join us on social networks and share our announcements:
- Website: https://uvnc.com/
- GitHub: https://github.com/ultravnc
- Mastodon: https://mastodon.social/@ultravnc
- Facebook: https://www.facebook.com/ultravnc1
- X/Twitter: https://x.com/ultravnc1
- Reddit community: https://www.reddit.com/r/ultravnc
- OpenHub: https://openhub.net/p/ultravnc
Important: Please update to latest version before to create a reply, a topic or an issue: https://forum.uvnc.com/viewtopic.php?t=37864
Join us on social networks and share our announcements:
- Website: https://uvnc.com/
- GitHub: https://github.com/ultravnc
- Mastodon: https://mastodon.social/@ultravnc
- Facebook: https://www.facebook.com/ultravnc1
- X/Twitter: https://x.com/ultravnc1
- Reddit community: https://www.reddit.com/r/ultravnc
- OpenHub: https://openhub.net/p/ultravnc
MSLogon II and Local Users/Group rejected
-
Rudi De Vos
- Admin & Developer
- Posts: 6863
- Joined: 2004-04-23 10:21
- Contact:
Re: MSLogon II and Local Users/Group rejected
Old info but it could still be the case in newer OS's
ForceGuest registry value is set to 1 by default in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
If the Guest account is enabled, an SSPI logon will succeed as Guest for any user credentials.
If ForceGuest is disabled (set to 0), SSPI will log on as the specified user.
So it's important to disable ForceGuest. Otherwise all authorization is done against the guest account!
Policy Settings: Authentication will fail if "Deny logon to the computer from the network" is enabled for a group the logon account is a member of. This applies to both Local Policy Settings as well as Group Policy Objects.
So make sure user accounts used for MS Logon authentication are not affected by these settings.
ForceGuest registry value is set to 1 by default in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
If the Guest account is enabled, an SSPI logon will succeed as Guest for any user credentials.
If ForceGuest is disabled (set to 0), SSPI will log on as the specified user.
So it's important to disable ForceGuest. Otherwise all authorization is done against the guest account!
Policy Settings: Authentication will fail if "Deny logon to the computer from the network" is enabled for a group the logon account is a member of. This applies to both Local Policy Settings as well as Group Policy Objects.
So make sure user accounts used for MS Logon authentication are not affected by these settings.