Domains and authentication problems

[SteveC]

Hi all,

Right, Users in India using VPN to get to our network here in England.

The VPN itself works fine. They can ping all PCs in our office, but can only connect (map drives) to all machines apart from the domain controllers.

If I connect over dial up myself (laptop running XPPro) I have no problems. I've been looking at this most of the day, and am completely lost as to why authentication is failing to our PDC (well, a Win2k3 AD). What happens is that when you do Start->Run->< server name > or map a drive, you are repeatedly asked to log in, as if you username or password were wrong. Looking at the logs though show successful authentication!

It must be some security issue on their PCs - we've been playing with one of them, removing it from their domain etc, but still can't get it to login to these servers. The two PCs I've been looking at today of theirs - one's a win2k pro box and the other a win2k3 enterprise server.

Anyone any ideas?

Cheers,
Steve

[DentyCracker]

What sort of authentication are you using? Is the client set to use the same authentication as the server expects?

[DentyCracker]

I was thinking can YOU tunnel in to the VPN over the internet? If you can then it may be that you need their machines' vpn connection to be setup just as yours is. ALso, ensure that they have proper permission to access the resources you say they can't

[Dilitante1]

sounds like a forest permission issue

[Sasq]

are the users in india getting an ip on your network, or do they have a subnet that is tunneled to yours.

Your Domain Controlers will only broadcast correctly to their network, in that case.

From pre coffee memory you will need a wins forwarding server. Terminology escapes me early on a sat morning with hangover.

[SteveC]

The users in India get the same IP address subnet as I do here when I dial up and come in over the VPN.

The VPN software (NetScreen/SafeNet) is the same there as it is here for me too.

[agallag]

Is there any chance they have a different set of IP ports open than you do?

Is there anything in the domain controller policy (computer configuration/windows settings/security settings/local policies/user rights assignment) restricting their group from access the computer over the network? Look at "access this computer from the network" and "deny access to this computer from the network".

Can the users ping the domain controllers?

Is there any kind of IPSec policy on the DCs that the users don't have themselves?

That's all I can think of at the moment. Make sure you check everything in the DC policy to see if anything is restricting access to them.

[Taz]

Could be something their ISP is doing I had a problem connecting up some home workers using Linksys VPN routers, the ones on ADSL and Blueyonder all worked fine, the two on NTL had problems. They could initialise a VPN connection to the office Ok, PING and NBTSTAT worked fine but like you mapping drives failed. Trying to connect to Exhange via Outlook either timed out or took forever and a day

[Kurt]

Where's the VPN endpoint? In your domain or outside? Did you check the firewall rules (assuming you have one)?

[xortam]

Ahhh ... brings back such memories. I was looking at this stuff over five years ago and I haven't thought much about it since. Guess I'll start playing with the AD implementation now that its been out a while. I hope it holds up (wasn't NDS strength architecture).

Can you change permissions on a user and they'll still have access until they reboot? It was originally architected in such a way that allowed this.

[SteveC]

I can't see how it can be any setting on the DCs or on our network because I can externally dial up and connect over the same VPN with same user profiles, usernames and passwords and it works perfectly for me.

[Byock]

Is your laptop a member of the domain? I assume they are not, coming from India. To do a true test, you would need to try your dialup with a machine not already a member of the domain.

[SteveC]

Nope - tried from two laptops now, neither are members of any domain.

[Wombat]

Found this and thought of you: http://www.greyware.com/software/dom...ct/w32time.asp

[Kurt]

To save everybody time

"NET TIME doesn't work well with laptops and remote offices.
The login script problems mentioned above are magnified dramatically if you're using a laptop or workstation remotely, since the workstation may or may not actually authenticate with an NT domain when dialing in (if you're using a PPP dial-in service, or over the Internet using a third-party VPN, for example).

Also, a workstation with a NET TIME command scheduled to run on a schedule (such as the NT AT command) can cause a system using Dial-Up networking to attempt to dial the remote network when it tries to run. "

So it might be a time synchro problem...