|
Home > Archive > IIS Server Security > October 2005 > Security events (failures) using UPN
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Security events (failures) using UPN
|
|
|
| I am publishing a WSS site in an extranet scenario, authentication scheme is
Integrated and users authenticate using a UPN that matches their email
address (eg; john.smith@partnercompany.com), all the relevant UPN suffixes
have been added into AD and the user accounts created using the first part
of the email as the "logon name" and the relevant UPN suffix, the NETBIOS
name is MYDOMAIN\logonname_XX (where XX is a two letter suffix mapping to
the company name to avoid NetBOIS logon name conflicts).
The authentication works fine, with the exception that we get lots of 680
events in the security log:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 05/10/2005
Time: 12:57:21
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: example.user@partnercompany001.com
Source Workstation: OPSWS001782
Error Code: 0xC0000064
Always followed by a success:
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 05/10/2005
Time: 12:57:21
User: MYDMZDOMAIN\example.user_XX
Computer: SERVERNAME
Description:
Successful Network Logon:
User Name: example.user_XX
Domain: MYDMZDOMAIN
Logon ID: (0x0,0x25175DA8)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: OPSWS001782
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: removed
Source Port: 1403
I suspect this is related to Kerberos failing over to NTLM, or a permissions
problem within AD.
The server is hosted in a DMZ with only port 80 opened up to the outside
world (or the internal network).
These errors occur for anyone who logs in using UPN, even
'administrator@MYDMZDOMAIN.local', logging in using NetBIOS format
(MYDMZDOMAIN\user) does not generate these errors.
Until we can use ADDS in production next year this is the only access
mechanism available to us...
Any ideas?
--
MattG
MCP x 2
| |
| Ken Schaefer 2005-10-12, 6:15 pm |
| I don't know if this helps you but 0xC0000064 is "the specified user does
not exist"
Cheers
Ken
"MattG" <email@theforceiswithme.com.SPAMTRAP> wrote in message
news:u2PKIZayFHA.2072@TK2MSFTNGP14.phx.gbl...
:I am publishing a WSS site in an extranet scenario, authentication scheme
is
: Integrated and users authenticate using a UPN that matches their email
: address (eg; john.smith@partnercompany.com), all the relevant UPN suffixes
: have been added into AD and the user accounts created using the first part
: of the email as the "logon name" and the relevant UPN suffix, the NETBIOS
: name is MYDOMAIN\logonname_XX (where XX is a two letter suffix mapping to
: the company name to avoid NetBOIS logon name conflicts).
:
: The authentication works fine, with the exception that we get lots of 680
: events in the security log:
:
: Event Type: Failure Audit
: Event Source: Security
: Event Category: Account Logon
: Event ID: 680
: Date: 05/10/2005
: Time: 12:57:21
: User: NT AUTHORITY\SYSTEM
: Computer: SERVERNAME
: Description:
: Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
: Logon account: example.user@partnercompany001.com
: Source Workstation: OPSWS001782
: Error Code: 0xC0000064
:
: Always followed by a success:
:
: Event Type: Success Audit
: Event Source: Security
: Event Category: Logon/Logoff
: Event ID: 540
: Date: 05/10/2005
: Time: 12:57:21
: User: MYDMZDOMAIN\example.user_XX
: Computer: SERVERNAME
: Description:
: Successful Network Logon:
: User Name: example.user_XX
: Domain: MYDMZDOMAIN
: Logon ID: (0x0,0x25175DA8)
: Logon Type: 3
: Logon Process: NtLmSsp
: Authentication Package: NTLM
: Workstation Name: OPSWS001782
: Logon GUID: -
: Caller User Name: -
: Caller Domain: -
: Caller Logon ID: -
: Caller Process ID: -
: Transited Services: -
: Source Network Address: removed
: Source Port: 1403
:
:
: I suspect this is related to Kerberos failing over to NTLM, or a
permissions
: problem within AD.
: The server is hosted in a DMZ with only port 80 opened up to the outside
: world (or the internal network).
:
: These errors occur for anyone who logs in using UPN, even
: 'administrator@MYDMZDOMAIN.local', logging in using NetBIOS format
: (MYDMZDOMAIN\user) does not generate these errors.
:
: Until we can use ADDS in production next year this is the only access
: mechanism available to us...
:
:
: Any ideas?
:
:
:
: --
:
:
: MattG
: MCP x 2
:
:
:
| |
|
| Thanks Ken,
Yeah, an MSDN search told me the "user doesn't exist", but I must disagree
with MSDN here as they do!!
It's no biggie as authentication does work, just with a spurious error in
the event log...
I just hope the partners IT dept's are as keen on ADFS as I am!
m@
"Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
news:e0tw3JuzFHA.916@TK2MSFTNGP10.phx.gbl...
>I don't know if this helps you but 0xC0000064 is "the specified user does
> not exist"
>
> Cheers
> Ken
>
>
> "MattG" <email@theforceiswithme.com.SPAMTRAP> wrote in message
> news:u2PKIZayFHA.2072@TK2MSFTNGP14.phx.gbl...
> :I am publishing a WSS site in an extranet scenario, authentication scheme
> is
> : Integrated and users authenticate using a UPN that matches their email
> : address (eg; john.smith@partnercompany.com), all the relevant UPN
> suffixes
> : have been added into AD and the user accounts created using the first
> part
> : of the email as the "logon name" and the relevant UPN suffix, the
> NETBIOS
> : name is MYDOMAIN\logonname_XX (where XX is a two letter suffix mapping
> to
> : the company name to avoid NetBOIS logon name conflicts).
> :
> : The authentication works fine, with the exception that we get lots of
> 680
> : events in the security log:
> :
> : Event Type: Failure Audit
> : Event Source: Security
> : Event Category: Account Logon
> : Event ID: 680
> : Date: 05/10/2005
> : Time: 12:57:21
> : User: NT AUTHORITY\SYSTEM
> : Computer: SERVERNAME
> : Description:
> : Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> : Logon account: example.user@partnercompany001.com
> : Source Workstation: OPSWS001782
> : Error Code: 0xC0000064
> :
> : Always followed by a success:
> :
> : Event Type: Success Audit
> : Event Source: Security
> : Event Category: Logon/Logoff
> : Event ID: 540
> : Date: 05/10/2005
> : Time: 12:57:21
> : User: MYDMZDOMAIN\example.user_XX
> : Computer: SERVERNAME
> : Description:
> : Successful Network Logon:
> : User Name: example.user_XX
> : Domain: MYDMZDOMAIN
> : Logon ID: (0x0,0x25175DA8)
> : Logon Type: 3
> : Logon Process: NtLmSsp
> : Authentication Package: NTLM
> : Workstation Name: OPSWS001782
> : Logon GUID: -
> : Caller User Name: -
> : Caller Domain: -
> : Caller Logon ID: -
> : Caller Process ID: -
> : Transited Services: -
> : Source Network Address: removed
> : Source Port: 1403
> :
> :
> : I suspect this is related to Kerberos failing over to NTLM, or a
> permissions
> : problem within AD.
> : The server is hosted in a DMZ with only port 80 opened up to the outside
> : world (or the internal network).
> :
> : These errors occur for anyone who logs in using UPN, even
> : 'administrator@MYDMZDOMAIN.local', logging in using NetBIOS format
> : (MYDMZDOMAIN\user) does not generate these errors.
> :
> : Until we can use ADDS in production next year this is the only access
> : mechanism available to us...
> :
> :
> : Any ideas?
> :
> :
> :
> : --
> :
> :
> : MattG
> : MCP x 2
> :
> :
> :
>
>
|
|
|
|
|