Taylor, Jonn
2013-Dec-05 17:30 UTC
[Samba] Samba 4 ADDC auth problem with RDWeb app server
I have a samba 4 domain,from master, that orginally started as a win2k3
domain. The domain was upgraded to 2k8r2 with the M$ tools. I now only
have 2 S4 DC's that seem to working fine. No errors in the log files,
-d4. I have 1 win2k8r2 server that is a member server that provides
remote desktop services. I added the webapp service to but I am having
problem. I can never see the apps when logged in as a domain user. If I
login with the local admin account on the server it works fine. Here is
what I am seeing.
I spent some time online looking for a solution with no luck. The server
is part of the windows authorization access group.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 12/5/2013 11:16:50 AM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: TS-SERVER.taylortelephone.com
Description:
An account failed to log on.
Subject:
Security ID: IIS APPPOOL\RDWebAccess
Account Name: RDWebAccess
Account Domain: IIS APPPOOL
Logon ID: 0x40fa5
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xc000009a
Sub Status: 0x0
Process Information:
Caller Process ID: 0x8a4
Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe
Network Information:
Workstation Name: TS-SERVER
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Authz
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on
the computer where access was attempted.
The Subject fields indicate the account on the local system which
requested the logon. This is most commonly a service such as the Server
service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The
most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the
system requested the logon.
The Network Information fields indicate where a remote logon request
originated. Workstation name is not always available and may be left
blank in some cases.
The authentication information fields provide detailed information about
this specific logon request.
- Transited services indicate which intermediate services have
participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key.
This will be 0 if no session key was requested.
Event Xml:
<Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing"
Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4625</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2013-12-05T17:16:50.422074900Z" />
<EventRecordID>8378</EventRecordID>
<Correlation />
<Execution ProcessID="476" ThreadID="540" />
<Channel>Security</Channel>
<Computer>TS-SERVER.taylortelephone.com</Computer>
<Security />
</System>
<EventData>
<Data
Name="SubjectUserSid">S-1-5-82-604604840-3341247844-1790606609-4006251754-2470522317</Data>
<Data Name="SubjectUserName">RDWebAccess</Data>
<Data Name="SubjectDomainName">IIS APPPOOL</Data>
<Data Name="SubjectLogonId">0x40fa5</Data>
<Data Name="TargetUserSid">S-1-0-0</Data>
<Data Name="TargetUserName">
</Data>
<Data Name="TargetDomainName">
</Data>
<Data Name="Status">0xc000009a</Data>
<Data Name="FailureReason">%%2304</Data>
<Data Name="SubStatus">0x0</Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">Authz </Data>
<Data
Name="AuthenticationPackageName">Kerberos</Data>
<Data Name="WorkstationName">TS-SERVER</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x8a4</Data>
<Data
Name="ProcessName">C:\Windows\System32\inetsrv\w3wp.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
</EventData>
</Event>
PS Z:\> dcdiag.exe /s:dc1
Directory Server Diagnosis
Performing initial setup:
* Identified AD Forest.
[dc1] An LDAP operation failed with error 31
Got error while checking if the DC is using FRS or DFSR. Error:
A device attached to the system is not functioning.The
VerifyReferences, FrsEvent and DfsrEvent tests might fail
because of this error.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\DC1
Starting test: Connectivity
......................... DC1 passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\DC1
Starting test: Advertising
Warning: DsGetDcName returned information for
dc1.taylortelephone.com, when we were trying to reach DC1.
SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
......................... DC1 failed test Advertising
Starting test: FrsEvent
......................... DC1 passed test FrsEvent
Starting test: DFSREvent
......................... DC1 passed test DFSREvent
Starting test: SysVolCheck
The SysVol is not ready. This can cause the DC to not
advertise itself as a DC for netlogon after dcpromo.
Also trouble with FRS SysVol replication can cause Group
Policy problems. Check the FRS event log on this DC.
......................... DC1 failed test SysVolCheck
Starting test: KccEvent
......................... DC1 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... DC1 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... DC1 passed test MachineAccount
Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=taylortelephone,DC=com
......................... DC1 failed test NCSecDesc
Starting test: NetLogons
......................... DC1 passed test NetLogons
Starting test: ObjectsReplicated
Failed to read object metadata on DC1, error The request is
not supported.
Failed to read object metadata on DC1, error The request is
not supported.
......................... DC1 passed test ObjectsReplicated
Starting test: Replications
ERROR: Unexpected number of reps-to neighbors returned from DC0.
ERROR: Unexpected number of reps-to neighbors returned from DC0.
ERROR: Unexpected number of reps-to neighbors returned from DC0.
REPLICATION-RECEIVED LATENCY WARNING
DC1: Current time is 2013-12-05 11:20:03.
CN=Schema,CN=Configuration,DC=taylortelephone,DC=com
Last replication received from DC0 at
1969-12-31 18:00:00
WARNING: This latency is over the Tombstone Lifetime of
180 days!
DC=DomainDnsZones,DC=taylortelephone,DC=com
Last replication received from DC0 at
1969-12-31 18:00:00
WARNING: This latency is over the Tombstone Lifetime of
180 days!
DC=ForestDnsZones,DC=taylortelephone,DC=com
Last replication received from DC0 at
1969-12-31 18:00:00
WARNING: This latency is over the Tombstone Lifetime of
180 days!
DC=taylortelephone,DC=com
Last replication received from DC0 at
1969-12-31 18:00:00
WARNING: This latency is over the Tombstone Lifetime of
180 days!
CN=Configuration,DC=taylortelephone,DC=com
Last replication received from DC0 at
1969-12-31 18:00:00
WARNING: This latency is over the Tombstone Lifetime of
180 days!
......................... DC1 passed test Replications
Starting test: RidManager
......................... DC1 passed test RidManager
Starting test: Services
Could not open EventSystem Service on DC1, error 0x8
"Not enough storage is available to process this
command."
Could not open RpcSs Service on DC1, error 0x8 "Not enough
storage is available to process this command."
Could not open NTDS Service on DC1, error 0x8 "Not enough
storage is available to process this command."
Could not open DnsCache Service on DC1, error 0x8
"Not enough storage is available to process this
command."
Could not open DFSR Service on DC1, error 0x8 "Not enough
storage is available to process this command."
Could not open IsmServ Service on DC1, error 0x8 "Not
enough storage is available to process this command."
Could not open kdc Service on DC1, error 0x8 "Not enough
storage is available to process this command."
Could not open SamSs Service on DC1, error 0x8 "Not enough
storage is available to process this command."
Could not open LanmanServer Service on DC1, error 0x8
"Not enough storage is available to process this
command."
Could not open LanmanWorkstation Service on DC1, error 0x8
"Not enough storage is available to process this
command."
Could not open w32time Service on DC1, error 0x8 "Not
enough storage is available to process this command."
Invalid service type: NETLOGON on DC1, current value
WIN32_OWN_PROCESS, expected value WIN32_SHARE_PROCESS
Invalid service startup type: NETLOGON on DC1, current
value DEMAND_START, expected value AUTO_START
......................... DC1 failed test Services
Starting test: SystemLog
......................... DC1 passed test SystemLog
Starting test: VerifyReferences
Some objects relating to the DC DC1 have problems:
[1] Problem: Missing Expected Value
Base Object:
CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=taylortelephone,D
C=com
Base Object Description: "DSA Object"
Value Object Attribute Name: serverReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862
[1] Problem: Missing Expected Value
Base Object: CN=DC1,OU=Domain
Controllers,DC=taylortelephone,DC=com
Base Object Description: "DC Account Object"
Value Object Attribute Name: frsComputerReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862
......................... DC1 failed test VerifyReferences
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
It appears this partition
(DC=DomainDnsZones,DC=taylortelephone,DC=com) has an empty replica set.
This
partition should be re-instantiated on the last replica to
hold this NC, or removed from the directory.
......................... DomainDnsZones passed test
CrossRefValidation
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
It appears this partition
(DC=ForestDnsZones,DC=taylortelephone,DC=com) has an empty replica set.
This
partition should be re-instantiated on the last replica to
hold this NC, or removed from the directory.
......................... ForestDnsZones passed test
CrossRefValidation
Running partition tests on : taylortelephone
Starting test: CheckSDRefDom
......................... taylortelephone passed test
CheckSDRefDom
Starting test: CrossRefValidation
......................... taylortelephone passed test
CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Running enterprise tests on : taylortelephone.com
Starting test: LocatorCheck
Error: The server returned by DsGetDcName() did not match
DsListRoles() for the PDC
......................... taylortelephone.com passed test
LocatorCheck
Starting test: Intersite
......................... taylortelephone.com passed test
Intersite
PS Z:\>
Possibly Parallel Threads
Wisdom of the Ancients
