Authentication failed error with MSlogon II

[suniltantry]

Hi,

I am using MS logon to authenticate myself to be able to use vnc and i am unable to connect to the target machine. I am getting the error authentication failed. I will not be able to connet to the remote machine even if i restart the machine. In the event viewer i get event ID as 2.

2. also in a couple of machines when there is a succesful authentication the remote machine reboots automatically. Please advice.

---Thanks & Regards,
Sunil.

[Marscha]

which version of UltraVNC do you use?
MS-Logon I or II?
OS version?
Any firewall, NAT etc. in between?
If you use classic VNC auth, does it work?

[suniltantry]

Hi,
Version is 1.0.1( availavle of the website)
OS is Win XP sp2/Win2003 SP1
No firewalls. I have around 10 systems in my test lab and i am able to connect to 7 of them approximately. This is a intermitant problem. I happens on some machine and not on some.
yes classic vnc authentication works.

[redge]

OS is Win XP sp2/
...
This is a intermitant problem. I happens on some machine and not on some.

XP sp2 are too much generic for this issue.
These some unworking are Windows XP Professional or XP Home ?
XP Home can't allow logon as MS Logon II with and without the flag ForceGuest=0 below:
1 solution
Did you check registry of unworking computer ?

Under Windows XP, the ForceGuest registry value is set to 1 by default in the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
If the Guest account is enabled, an SSPI logon will succeed as Guest for any user credentials.
If ForceGuest is disabled (set to 0), SSPI will log on as the specified user.
So it's important to disable ForceGuest. Otherwise all authorization is done against the guest account!

2nd solution
upgrade to uvnc 1.0.2
[topic=6956][/topic]

[suniltantry]

Hi,

All the machines are win xp prof with SP2. I checked the registry of the unworking computer and all seems to be perfect with link how u said. Still does not work. I there any other alternative. I have also noticed that some times if we restart the service it works.

Please advice.

[suniltantry]

Also one more thing i some times get failed to connect to server error. I have installed vnc and vnc sever is running on that machine. Please advice.

[Marscha]

You could activate the logging in VNC server and have a look at the resulting log file.
Check "Log debug infos to the WinVNC.log file" in UltraVNC Admin Properties.
Set HKLM\Software\ORL\WinVNC3\DebugLevel to 10 or 100.

When running winvnc as a service, the log file is in C:\Windows\system32

[JVH]

I have been having a similar problem for some time now.
I use Win2000pro on all machines with VNC 1.0.1.
I set the groups in MS logon II to Administrators and Domain Admins
I set nothing in MS logon I. It is not available when II is selected.
I have determined the problem to be that I can't logon to any machine that I do not have a local account on. The software does not appear to be checking the groups.

[Marscha]

MS-Logon II is definitely checking the groups.
It's the same mechanism that is used for accessing shares etc.
Create a share on the computer and set access rights to the same groups/users as in MS-Logon II.
Then do a 'net use' from another machine with the same credentials.
If you can access the share then MS-Logon should also work.

[suniltantry]

Hi.. Nothing gets written in the log except that the authentication faild for the user.

[markj]

I was just having the same problem after a reinstall.

It was driving me crazy because as far as I could tell everything was the same as the other systems on the network and they could all still connect.

This thread, in its own way help me solve the problem.

The solution

Turn off simple file sharing!

Open an Explorer window>Tools>Folder Options>View>The bottom check box

[mfo2]

Hi,

I'm jumping in the thread because I once find out that if the computer you want to take control to has been "secured" by removing everyone and administrators from the "Access this computer from the network" user right (see in gpedit.msc), then MSLogon II will fail but MSLogon I will succeed.

My 2 (euro)cents

Marc

[ragnar2099]

Wow that was too easy. Markj's post worked. Thanks. I never would have tried that.

The solution

Turn off simple file sharing!

Open an Explorer window>Tools>Folder Options>View>The bottom check box

[reaper829]

Markj's post worked for me too. Thanks!