Authentication Issues

[mashdots]

Hello there.

I use uVNC to connect to other PCs in my domain (not servers) for remote support across three different states. I run the latest version, while others may be an iteration or two below 1.2.05. I run Windows 7 Pro as do all the PCs I am connecting to. All the PCs are on the domain and use the MS Login which is validated using domain credentials set up in our Active Directory.

For a while now, everything has been smooth sailing and we've had no problems with connectivity. Most recently (within the past 2 weeks) however, something happened that I can't put my finger on which has caused a majority of our computers to reject authentication. What's strange is that not all of them do, and I am able to still connect with no problems to a handful of PCs. But most of them, even when they are at my location, will return a "Authentication Rejected" message, despite providing correct credentials.

I see a lot of "authentication rejected" threads, but none that quite address the odd situation I'm looking at. Or maybe I am overlooking something. Any help would be appreciated!

Thank you!

[Rudi De Vos]

Ultravnc use file permission to check access, looks like this new MS patch is the cause. ( ntlm is used to authenticate AD users)
Found this for another software that has the same issue's

Description
Installing MS15-027 (KB3002657) 'basically' disables NTLM authentication to mitigate the vulnerability described in the Microsoft Security Bulletin. Installing this patch may cause authentication failures on network machines where Kerberos authentication is disabled and NTLM is used to authenticate Active Directory users.

According to the Microsoft Security Bulletin, this patch is only required on Domain Controllers. The following was information was taken directly from the bulletin: "This update is applicable on server machines running as domain controllers. It is suggested, however, that the update be applied to all affected platforms so that machines are protected if they are promoted to domain controller role in the future."

More information about the patch can be found here: https://support.microsoft.com/en-us/kb/3002657

Resolution
Defining a local security policy on the console machine. Go to Local Security Policy > Local Policies > Security Options > Network Security: LAN Manager authentication level, if set to "Not Defined", change to the second level "Send LM & NTLM - use NTLMv2 session security if negotiated".
Uninstall MS15-027 (KB3002657) from the target machines.
Please note: Uninstall the patch a Domain Controller that requires this patch could leave the server vulnerable.
The Microsoft workaround is to use the Kerberos protocol to authenticate Active Directory domain users.

[superlaguna]

I have the same issue:

tried:
-giving 'everyone' full access permissions to * under c:\program files\uvnc bvba\Ultravnc
-computer is windows 7 64 and does not have KB3002657 installed


the weird thing is my domain username/pass lets me in, however others in the same AD group as me still get Authentication rejected.

can anyone fix this bug, i have tried everything, and i need domain security, thanks

[ST]

Hi, it doesn't sound like domain/NTLM authentication is a popular feature but we depend on this as well. Any chance Kerberos support could be a feature request so we can continue using ultravnc and patch our systems?

[Rudi De Vos]

It's on the todo list... but this is not something easy to test, on my own AD i still get access.
I already isolated the check part in a simple (user/Passwd -> read/write access OK Fail) test app.

I need someone with the problem todo some tests ( aug/sept)...i can't repeat it on my own.

[JVH]

I believe I have been having the same issue for some time now.
Our network as all WINXP Pro workstations running against an SBS 2003 server.
Recently we started the process up upgrading our workstations.
However every new workstation with WIN 7 pro, Win 8.1 Pro, or Win 10 Pro has authentication rejected errors for all users in the list.
The one exception is if I use the server username administrator and password I can get it to accept the login.

We are also planning to change out the server and OS in the next 60 days.
This fails consistently, so if someone needs me to test something I am willing to do so.

John