Re: NTLM authentication

"webrod" <rodolphe.aoustin@xxxxxxxxx> wrote in message news:1168242607.530464.16420@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Willy,

I am very surpised!!
I have tested with 4 employees in my companies.
My PC is a new one: there is NO local accounts.
They do NOT exist on my PC!!
This is true, this is my OWN PC, I mean I am the person who access this
PC and only me.
If I authenticate as I did againt ADAM with their login/pwd, it works.
If I enter a WRONG pwd, it doesn NOT authenticate (so it is the proof
that the default authentication type is NOT "None".)
And you can beleive me, there is no local users on my PC except:
Administrator, admin, ASPNET, IUSR_BW200120, console_de.

You are saying "ADSI know which domain controller stores BOB's
credentials?", this is a good question, I guess it knows the domain of
the current user so it tries to authenticates BOB with this domain, or
I don't know... But it does


Say that the user is "administrator" with password "adminpwd", what administrator would be used to authenticate, the LOCAL admin or the DOMAIN admin,?? According to you it would use the domain administrator, well, I say it's not.
There must something wrong with your set-up or your code, really.

Please do yourself and us a favor and try to answer the following questions:
- What Framework version are you running on XP?
- Are you logged on into your domain or locally?
- Your DC is running NT4, right? .
- Enable (success and Fail) Logon auditing in your Local Security Policy. Clear the Security EventLog and watch the security events after each bind. Note that this can' be done on NT4, so you can only watch the local logon attempts.
- What happens if you run ldp.exe (from the ADAM prompt) and execute:
Connect to localhost port 389 (the defaults)
Bind using NTLM:
enter User (BOB or whatever you consider a valid domain account) and Password, leave Domain empty
press advanced, select NTLM from the list and press OK
press OK in the Bind dialog
This should fail because authentication will be done to the LOCAL SAM and you said BOB is non local (which I believe).
Now try the same specifying the domain name, this should succeeds.
- How does your path string looks like? Are you sure you specify the port like this:
DirectoryEntry(LDAP://server:389 ...
where server is the server name running ADAM and 389 the port on which the instance is listening (here the default)

- Now, use the "domain\\user" syntax for the username in your DirectoryEntry constructor, where domain is your logon domain (NT4) and user a domain account. This is the syntax that makes it possible for the Security Provider to make a distinction between a local account and a domain account.
- what's the result when running this code?
- and what logon events do you get in your Security log?

Willy.





.

Relevant Pages

  • Re: IAS & Fully-Qualified-User-Name
    ... Svyatoslav Pidgorny, MS MVP - Security, MCSE -= F1 is the key =- "Bryan Hunt" wrote in message ... > Logon Failure: ... > Caller User Name: MANAGE1$ ... >>> None of them will authenticate the user. ...
    (microsoft.public.security)
  • Re: Logon Error - Event ID 533
    ... The suggestion regarding security logs should not apply if the overwrite option has been selected and you have the default maximum of 512 kb. ... How to Set Log Size and Overwrite Options ... The user cannot logon and no Profile folder is made, ... screen whether with a domain account or a local account from the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Security Logging in ADAM
    ... Logon ID: ... you need "Audit account logon events" enabled in the server security policy. ... How does an anonymous login authenticate anyone? ... If a bind was performed against ADAM, there should be a matching audit ...
    (microsoft.public.windows.server.active_directory)
  • Re: Logon Error - Event ID 533
    ... The second is for Workstations, again does not apply in my ... The user cannot logon and no Profile folder is made, ... it causes the system to halt if a security ... or domain account look for the domain or computer name preceding the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: [ok] [Full-Disclosure] RE: [Full-Disclosure]MS should re-write code with security in mind
    ... almost all Windows users demand backward compatibility. ... > security upgrades available on MS's site. ... > and authenticate all mail transfer. ...
    (Full-Disclosure)