RPC and Kerberos error

-

hi,

i have following set up:

in doamin 1: rpc server (win 32 service) - running in system account. registered spn myservice\fqdn. ( myservice\machine.domain1.com  and  myservice\machine)

in domain 2: rpc client (desktop applicaiton): running in domain administrator account. using above spn connect server. logged in system domain administrator.

both domains , machines win2k3 server. same problem observed in win2k8r2 domain.

using rpc_c_authn_gss_negotiate both rpc server , client. , found client not able find server , returns access denied error. however, if change service type rpc_c_authn_winnt, client able communicate server.

i did network capture , observed :

75505    75.431571            10.216.125.241   10.216.121.214   krb5      tgs-req

75506    75.432846            10.216.121.214   10.216.125.241   krb5      krb error: krb5kdc_err_s_principal_unknown

75508    75.433783            10.216.129.188   10.216.125.241   smb       write andx response, fid: 0x000d, 132 bytes

75509    75.433974            10.216.125.241   10.216.129.188   smb       read andx request, fid: 0x000d, 1024 bytes @ offset 0

75510    75.434398            10.216.129.188   10.216.125.241   dcerpc               bind_ack: call_id: 2738, ntlmssp_challenge accept max_xmit: 4280 max_recv: 4280

75511    75.434792            10.216.125.241   10.216.129.188   dcerpc               auth3: call_id: 2738, ntlmssp_auth, user: clientdomain\administrator

75512    75.435255            10.216.129.188   10.216.125.241   smb       write andx response, fid: 0x000d, 214 bytes

75513    75.435431            10.216.125.241   10.216.129.188   winreg                openhklm request

75514    75.447385            10.216.129.188   10.216.125.241   dcerpc               fault: call_id: 2738 ctx_id: 0 status: nca_s_fault_access_denied

 

kerberos debug logs shows:
[472] 472.568> kerb-warn: spinitlsamodecontext failed outbound ticket, kerbgetserviceticket failed  with 0xc000018b

[472] 472.568> kerb-warn: spn not found

[472] 472.568> kerb-cred: cant go off box w/ non-fwdble logon session & no supp creds.

my questions are:

1)     does kerberos requires cross domain trust work correctly? cross domain, need supply explicit credentials or other configuration. how verify these configuration?. why not requried winnt.

2)     if rpc_c_authn_winnt works why not rpc_c_authn_gss_negotiate ?
 why fallback ntlm not working? if spn not found , should fallback  ntlm , should work winnt service type.

please me on this.

 regards..

 



Windows Server  >  Security



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = ce...
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer foll...
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically....
Read more