Active Directory

The logon attempt failed

Hello All,

Hope this post finds you in good health and spirit.

The logon attempt failed

or

“Your credentials did not work” error in Remote Desktop Connections?

Kerberos authentication failing “The logon attempt failed” after installing the Jan 2023 patches . We have multiple member servers that has windows 2003 OS and hosting the legacy application setup. application team unable to migrate these application to higher AES encryption method due to vendor unsupported or incomplete legacy application knowledge.

 Earlier kerberos support the RC4 encryption for legacy application but after installing Microsoft jan 2023 windows patches kerberos authentication is failing for RC4 encryption.

Workaround

  • Uninstall the latest windows patches from domain controllers and your legacy application will start getting authentication from domain controllers using RC4 encryption key.
  • Please add the below registry entry on domain controllers to support RC4 protocol.
HKLM\SYSTEM\CurrentControlSet\Services\KDC\DefaultDomainSupportedEncTypes with a value of 0x7.

If you have multiple domain controllers in environment, please add this registry value via GPO instead making changes on all DCs manually. But please keep in mind this is temporary workaround and we should not place it as permanently. As we know RC4 encryption is insecure and vulnerable and we should not keep our domain controller as vulnerable. Also change the value of computer object in AD for the Windows Server 2003 file server msDS-SupportedEncryptionTypes attirbute a value of 4.

You can use the powershell command:

Set-ADComputer NameSERVERWithUnsupportedSO -Add @{'msDS-SupportedEncryptionTypes'=4}
Or
Set-ADComputer NameSERVERWithUnsupportedSO -Add @{'msDS-SupportedEncryptionTypes'=7}

Important note- Please try to upgrade your existing Legacy applications to higher encryption so that your application can authenticate with domain controllers that are using AES 128 and AES 256 bit encryption.

So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!

Recommended content

How to Check the Active Directory Database Integrity

Disabling and Enabling the Outbound Replication

DFS Replication Service Stopped Replication

What is Strict Replication Consistency

The replication operation failed because of a schema mismatch between the servers involved

Troubleshooting ad replication error 8418 the replication operation failed because of a schema mismatch between the servers

How to export replication information in txt file

Repadmin Replsummary

Enabling the outbound replication

Disabling and enabling replication on schema master domain controller

How to enable strict replication consistency

How to prevent lingering objects replication in active directory

AD replication process overview

How to force active directory replication

Change notification in replication process

How to check replication partner for a specific domain controller

dcdiag test replications

Guys please don’t forget to like and share the post.Also join our WindowsTechno Community and where you can post your queries/doubts and our experts will address them .

You can also share the feedback on below windows techno email id.

If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.

How useful was this post?

Click on a star to rate it!

As you found this post useful...

Follow us on social media!

Was this article helpful?
YesNo

Vipan Kumar

He is an Active Directory Engineer. He has been working in IT industry for more than 10 years. He is dedicated and enthusiastic information technology expert who always ready to resolve any technical problem. If you guys need any further help on subject matters, feel free to contact us on admin@windowstechno.com Please subscribe our Facebook page as well website for latest article. https://www.facebook.com/windowstechno

Leave a Reply

Back to top button