Error

Following Windows security updates in May 2018, when attempting to RDP to a Windows 10 Pro workstation the following error message is displayed after successfully entering user credentials:

An authentication error occurred. The function requested is not supported.

This could be due to CredSSP encryption oracle remediation

Screenshot

Debugging

• We have confirmed user credentials are correct.

• Rebooted the workstation.

• Confirmed on prem directory services are operational.

• Isolated workstations yet to apply the May security patch are not effected.

Can manage in the interim for on perm hosts, concerned about cloud based server access however. No occurrences on Server 2016 yet.

Thank you

PROBLEM

Domain member service reports the following when attempting to RDP from any Windows 10 workstation on the same domain or any Windows client from an external source:

• Remote Desktop cannot verify the identity of the remote computer because there is a time or date difference between your computer and the remote computer. Make sure your computer’s clock is set to the correct time, and then try connecting again. If the problem occurs again, contact your network administrator or the owner of the remote computer.

Member Server Event Log contains:

• EVENTID 5719. This computer was not able to set up a secure session with a domain controller in domain due to the following: The RPC server is unavailable.

• EVENTID 1054. The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

ENVIRONMENT

MEMBER SERVER

• This is the only server exhibiting the issue.
• Windows Server 2012 Standard R2.
• File server.
• SQL server.
• Event log reports errors above.
• Cannot RDP to server when issue occurs.
• DNS address set as PDC and SDC IP addresses.

PDC

• Windows Server 2012.
• Holds all FSMO roles.
• GC.
• Windows Firewall disabled for testing.
• No ERRORS reported, operating normally.
• AD services.
• DNS service.
• WINS service.
• Can RDP to all nodes and autheticate with domain user credentials.

SDC

• Windows Server 2016.
• GC.
• Windows Firewall disabled for testing.
• No ERRORS reported, operating normally.
• AD services.
• DNS service.
• WINS service.
• Can RDP to all nodes and autheticate with domain user credentials.

EXCHANGE SERVER

• Windows Server 2008.
• Exchange Server 2007
• Also added as a member server.
• No ERRORS reported, operating normally.
• Can RDP to all nodes and autheticate with domain user credentials.

WINDOWS 10 CLIENTS

• All Windows 10 clients operating normally.
• Can RDP to all nodes and autheticate with domain user credentials.

Some further information that maybe important:

• I had another domain controller that died (vserver). It was manually removed from the domain using the correct procedure (meta data remove, transfer roles, delete from DNS etc). Satifited this is no longer and issue. Server name has not appeared in any error logs. DCDIAG on existing domain controller (PDC, SDC) reports no errors. This was many months ago.

• When the domain controller (vserver) died workstations reported time sync issues. This was resolved on all client work stations using the W32TM commands detailed below many months ago. This W32TM has not resolved has not resolve the issue with the problematic member server issues documented here.

DEBUGGING

MEMBER SERVER

• I can RDP and authenticate as a local user on the server when the issue occurs.
• I cannot RDP and authenticate as a domain user on the server when the issue occurs.
• If I reboot the server the issue is resolved for 24 hours approx.
• Ensuring network firewall allows time queries to external sources.
• W32tm /resync /rediscover (all executed elevated).
• W32tm /query /configuration.
• W32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update.
• w32tm /config /syncfromflags:domhier.
• net stop w32time && net start w32time.
• GPUPDATE does not resolve the problem.
• NIC settings have the DNS and WINS address set as PDC and SDC server IP addresses.
• Removed from the domain , domain join again using wizard tools.
• When the issues occurs NSLOOKUP will resolve internal sever.internal.com domain addresses.
• When the issues occurs NSLOOKUP will resolve internal extenal domain addresses.
• When the issues occurs google Chrome deployed on the server will not display a web page. DNS confirmed operatinal via NSLOOKUP. I have seen this behaviour from workstation that deployed the application FIDDLER as the IE PROXY address is set to the machine loopback IP. Confirmed FIDDLER not installed on this member server.
• See REF1. Tested MMC, connect to computer , load SECURITY LOG.
• Set GROUP POLICY to allow Allow Remote Administration Exception and Allow File and Printer Sharing Exception.
• Confirm Windows Management Instrumentation service running domain controllers and member server.
• Confirm TCP/IP NetBIOS Helper service is running on domain controllers and member server.
• Confirm Remote Procedure Call service is running on domain controllers and member server.
• See REF2. Enabled `FAST LINK' on servers managed switch port.

Member Server w32tm /query /configuration results

[Configuration]
EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 10 (Local)
MaxPollInterval: 15 (Local)
MaxNegPhaseCorrection: 4294967295 (Local)
MaxPosPhaseCorrection: 4294967295 (Local)
MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 1 (Local)
UpdateInterval: 30000 (Local)

[TimeProviders]
NtpClient (Local)
DllName: C:\Windows\system32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: AllSync (Local)
NtpServer: time.windows.com (Local)

NtpServer (Local)
DllName: C:\Windows\system32\w32time.DLL (Local)
Enabled: 0 (Local)
InputProvider: 0 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 0 (Local)
InputProvider: 1 (Local)

Member Server w32tm /query /status result:

Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.1455078s
Root Dispersion: 0.0777873s
ReferenceId: 0x0D4FEF45 (source IP:  13.79.239.69)
Last Successful Sync Time: 05/07/2017 13:31:40
Source: time.windows.com
Poll Interval: 12 (4096s)

Member Server RPCping result:

Completed 1 calls in 15 ms
66 T/S or  15.000 ms/T

Granted these tests above were performed several hours post reboot when the issue has not reoccurred yet. I can repeat the test and post the results upon reoccurrence.

PDC

• DCDIAG reports no issues.
• NSLOOKUP resolves internal and external addresses.

PDC w32tm /query /status result:

Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.1517181s
Root Dispersion: 0.0426882s
ReferenceId: 0x338D2033 (source IP:  51.141.32.51)
Last Successful Sync Time: 05/07/2017 13:18:51
Source: time.windows.com
Poll Interval: 10 (1024s)

SDC

• DCDIAG reports no issues.
• NSLOOKUP resolves internal and external addresses.

SUMMARY

Seems clear its a time sync issue. I believe that is everything I have tried to date to debug and resolve this issue, will EDIT if I can remember anything else. Thank you for any help (desk / head / bang ). Keen to understand the root cause.

Scott

REFERENCES

REF1. http://social.technet.microsoft.com/wiki/contents/articles/4494.troubleshooting-the-rpc-server-is-unavailable.aspx

REF2. Spanning Tree blocking DHCP requests in Windows/BOOTP

REF2. https://nchrissos.wordpress.com/2013/04/26/configuring-time-on-windows-2008-r2-servers/

UPDATE-1

Edited following the comment from Joeqwerty (thank you Joe).

Current State

• No reocurence of this issue to date , approx 24 hours since this article was posted.
• No reboots.

Amendment

However the following change has been applied now (see REF3) on the problematic MEMBER SERVER:

• Reg Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type=NTP amended from NTP to NT5DS

• Windows Time service restarted..

• Output of w32tm /query /configuration now shows:

  [TimeProviders]
  NtpClient (Local)
  DllName: C:\Windows\system32\w32time.DLL (Local)
  Enabled: 1 (Local)
  InputProvider: 1 (Local)
  CrossSiteSyncFlags: 2 (Local)
  AllowNonstandardModeCombinations: 1 (Local)
  ResolvePeerBackoffMinutes: 15 (Local)
  ResolvePeerBackoffMaxTimes: 7 (Local)
  CompatibilityFlags: 2147483648 (Local)
  EventLogFlags: 1 (Local)
  LargeSampleSkew: 3 (Local)
  SpecialPollInterval: 3600 (Local)
  Type: NT5DS (Local)
  

• GPUPDATE applied

• Type: NT5DS (Local) still displayed when checking w32tm /query /configuration.

I need to leave this for a few days and try a reboot before I can confirm the issue has been resolved.

UPDATE-2

• Issue just reoccurred. An admin rebooted it before I could run any tests.
• On reboot w32tm /query /configuration still shows Type: NT5DS (Local)
• Will report back Monday.

• FYI w32tm /query /status

  Leap Indicator: 0(no warning)
  Stratum: 4 (secondary reference - syncd by (S)NTP)
  Precision: -6 (15.625ms per tick)
  Root Delay: 0.1827698s
  Root Dispersion: 7.8574884s
  ReferenceId: 0xC0A80103 (source IP:  192.168.1.3)
  Last Successful Sync Time: 06/07/2017 16:29:58
  Source: PDC.MYDOMAIN.COM
  Poll Interval: 10 (1024s)
  

Sorry for all the text.

UPDATE-3

No reoccurence of the RDP error document above yet but posted an update to highlight that at 0200 UTC the Member Server event log again started to report the EVENTID errors documented at the start of this thread chiefly:

• 5719. SOURCE NETLOGON. This computer was not able to set up a secure session with a domain controller in domain due to the following: The RPC server is unavailable.
• 1054. SOURCE GROUP POLICY. The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

In the past I found this was a precursor to the RDP connection / time sync problem given enough time.

In response I execute the following all from the MEMBER SERVER experiencing the issue:

• w32tm /query /status

  Leap Indicator: 0(no warning)
  Stratum: 4 (secondary reference - syncd by (S)NTP)
  Precision: -6 (15.625ms per tick)
  Root Delay: 0.8504282s
  Root Dispersion: 0.3015940s
  ReferenceId: 0xC0A80103 (source IP:  192.168.1.3)
  Last Successful Sync Time: 07/07/2017 06:08:58
  Source: PDC.MYDOMAIN.COM
  Poll Interval: 13 (8192s)
  

• w32tm /query /configuration

  [Configuration]
  EventLogFlags: 2 (Local)
  AnnounceFlags: 10 (Local)
  TimeJumpAuditOffset: 28800 (Local)
  MinPollInterval: 10 (Local)
  MaxPollInterval: 15 (Local)
  MaxNegPhaseCorrection: 4294967295 (Local)
  MaxPosPhaseCorrection: 4294967295 (Local)
  MaxAllowedPhaseOffset: 300 (Local)
  
  FrequencyCorrectRate: 4 (Local)
  PollAdjustFactor: 5 (Local)
  LargePhaseOffset: 50000000 (Local)
  SpikeWatchPeriod: 900 (Local)
  LocalClockDispersion: 10 (Local)
  HoldPeriod: 5 (Local)
  PhaseCorrectRate: 1 (Local)
  UpdateInterval: 30000 (Local)
  
  [TimeProviders]
  NtpClient (Local)
  DllName: C:\Windows\system32\w32time.DLL (Local)
  Enabled: 1 (Local)
  InputProvider: 1 (Local)
  CrossSiteSyncFlags: 2 (Local)
  AllowNonstandardModeCombinations: 1 (Local)
  ResolvePeerBackoffMinutes: 15 (Local)
  ResolvePeerBackoffMaxTimes: 7 (Local)
  vCompatibilityFlags: 2147483648 (Local)
  EventLogFlags: 1 (Local)
  LargeSampleSkew: 3 (Local)
  SpecialPollInterval: 3600 (Local)
  Type: NT5DS (Local)
  
  NtpServer (Local)
  DllName: C:\Windows\system32\w32time.DLL (Local)
  Enabled: 0 (Local)
  InputProvider: 0 (Local)
  VMICTimeProvider (Local)
  DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
  Enabled: 0 (Local)
  InputProvider: 1 (Local)
  

• RPCping

  Completed 1 calls in 1 ms
  1000 T/S or   1.000 ms/T
  

• Net time /Domain:mydomain.com.com

  Current time at \\PDC.MYDOMAIN.COM is 07/07/2017 06:51:29
  

• w32tm /query /source

  PDC.MYDOMAIN.COM
  

• W32tm /monitor /domain:mydomain.com

  PDC.MYDOMAIN.COM *** PDC ***[192.168.1.3:123]:
  ICMP: 0ms delay
  NTP: +0.0000000s offset from PDC.MYDOMAIN.COM
  RefID: (unknown) [0x33208D33]
  Stratum: 3
  SDC.MYDOMAIN.COM.COM[192.168.1.1:123]:
  ICMP: 0ms delay
  NTP: -0.0013367s offset from PDC.MYDOMAIN.COM
  RefID: PDC.MYDOMAIN.COM [192.168.1.3]
  Stratum: 4
  
  Warning:
  Reverse name resolution is best effort. It may not be
  correct since RefID field in time packets differs across
  NTP implementations and may not be using IP addresses.
  

The amended NT5DS settings are still in place. Give it a few hours and the RDP issues will reoccur. Not sure where to go from here sorry.

UPDATE-4

In response to Drifter104 , please find below the output of IPCONFIG/ALL for each node:

MEMBER SERVER

Windows IP Configuration
Host Name . . . . . . . . . . . . : memberserver
Primary Dns Suffix  . . . . . . . : mydomain.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.com

Ethernet adapter Ethernet:
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : HP Ethernet 1Gb 2-port 330i Adapter
Physical Address. . . . . . . . . : 28-80-23-90-ED-D8
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.25
DNS Servers . . . . . . . . . . . : 192.168.1.1
                                    192.168.1.3
Primary WINS Server . . . . . . . : 192.168.1.1
Secondary WINS Server . . . . . . : 192.168.1.3
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{C78DD9B1-685E-4DB0-BE2C-79D92494D094}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

PDC

Windows IP Configuration
Host Name . . . . . . . . . . . . : PDC
Primary Dns Suffix  . . . . . . . : mydomian.COM
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.COM

Ethernet adapter Ethernet:
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : HP Ethernet 1Gb 2-port 332i Adapter #2
Physical Address. . . . . . . . . : 64-51-06-0D-EE-C9
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::2440:bffc:b999:f930%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::217:c5ff:fe28:91cc%12
                                   192.168.1.25
DHCPv6 IAID . . . . . . . . . . . : 207900934
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1C-53-B2-D2-64-51-06-0D-EE-C9
DNS Servers . . . . . . . . . . . : 192.168.1.3
                                   192.168.1.1
                                   127.0.0.1
Primary WINS Server . . . . . . . : 192.168.1.1
Secondary WINS Server . . . . . . : 192.168.1.3
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{0C6841BD-69AB-491B-819B-9167B188139A}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

SDC

Windows IP Configuration
Host Name . . . . . . . . . . . . : SDC
Primary Dns Suffix  . . . . . . . : mydomain.COM
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.COM

Ethernet adapter Ethernet:
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : HP Ethernet 1Gb 2-port 332i Adapter
Physical Address. . . . . . . . . : 64-51-06-0D-EA-B8
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::e006:41b6:be7c:e580%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::217:c5ff:fe28:91cc%2
                                   192.168.1.25
DHCPv6 IAID . . . . . . . . . . . : 56905990
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-E6-6B-A7-64-51-06-0D-EA-B8
DNS Servers . . . . . . . . . . . : ::1
                                   192.168.1.1
                                   192.168.1.3
Primary WINS Server . . . . . . . : 192.168.1.3
Secondary WINS Server . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{0A5E9C3A-B92E-4114-B0BF-5A30BCA821D7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

MEMBER SERVER

WINS addresses removed on response to comment.

Windows IP Configuration
Host Name . . . . . . . . . . . . : memberserver
Primary Dns Suffix  . . . . . . . : mydomain.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.com

Ethernet adapter Ethernet:
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : HP Ethernet 1Gb 2-port 330i Adapter
Physical Address. . . . . . . . . : 28-80-23-90-ED-D8
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.25
DNS Servers . . . . . . . . . . . : 192.168.1.1
                                    192.168.1.3
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{C78DD9B1-685E-4DB0-BE2C-79D92494D094}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Will power cycle the machine shortly.

UPDATE-5 10/07/17

72 hours since the last update the issue has recurred. RDP and attempt to authenticate with the domain administrator user results in:

Remote Desktop cannot verify the identity of the remote computer because there is a time or date difference between your computer and the remote computer. Make sure your computer’s clock is set to the correct time, and then try connecting again. If the problem occurs again, contact your network administrator or the owner of the remote computer.

• Login as a local member service admin is successful.

• w32tm /query /status

  Leap Indicator: 0(no warning)
  Stratum: 4 (secondary reference - syncd by (S)NTP)
  Precision: -6 (15.625ms per tick)
  Root Delay: 0.1826172s
  Root Dispersion: 0.1925883s
  ReferenceId: 0xC0A80103 (source IP:  192.168.1.3)
  Last Successful Sync Time: 10/07/2017 04:27:51
  Source: PDC.MYDOMAIN.COM
  Poll Interval: 15 (32768s)
  

• w32tm /query /configuration

  [Configuration]
  EventLogFlags: 2 (Local)
  AnnounceFlags: 10 (Local)
  TimeJumpAuditOffset: 28800 (Local)
  MinPollInterval: 10 (Local)
  MaxPollInterval: 15 (Local)
  MaxNegPhaseCorrection: 4294967295 (Local)
  MaxPosPhaseCorrection: 4294967295 (Local)
  MaxAllowedPhaseOffset: 300 (Local)
  
  FrequencyCorrectRate: 4 (Local)
  PollAdjustFactor: 5 (Local)
  LargePhaseOffset: 50000000 (Local)
  SpikeWatchPeriod: 900 (Local)
  LocalClockDispersion: 10 (Local)
  HoldPeriod: 5 (Local)
  PhaseCorrectRate: 1 (Local)
  UpdateInterval: 30000 (Local)
  
  [TimeProviders]
  NtpClient (Local)
  DllName: C:\Windows\system32\w32time.DLL (Local)
  Enabled: 1 (Local)
  InputProvider: 1 (Local)
  CrossSiteSyncFlags: 2 (Local)
  AllowNonstandardModeCombinations: 1 (Local)
  ResolvePeerBackoffMinutes: 15 (Local)
  ResolvePeerBackoffMaxTimes: 7 (Local)
  CompatibilityFlags: 2147483648 (Local)
  EventLogFlags: 1 (Local)
  LargeSampleSkew: 3 (Local)
  SpecialPollInterval: 3600 (Local)
  Type: NT5DS (Local)
  
  NtpServer (Local)
  DllName: C:\Windows\system32\w32time.DLL (Local)
  Enabled: 0 (Local)
  InputProvider: 0 (Local)
  VMICTimeProvider (Local)
  DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
  Enabled: 0 (Local)
  InputProvider: 1 (Local)
  

• RPCping

  Exception 1722 (0x000006BA)
  Number of records is: 10
  ProcessID is 65644
  System Time is: 7/10/2017 6:7:3:935
  Generating component is 18
  Status is 0x6BA, 1722
  Detection location is 1442
  Flags is 0
  NumberOfParameters is 1
  Unicode string:
  ProcessID is 65644
  System Time is: 7/10/2017 6:7:3:935
  Generating component is 18
  ETC .... (large result)
  

• Net time /Domain:mydomain.com.com

  The service has not been started.
  

• w32tm /query /source

  PDC.mydomain.COM
  

• W32tm /monitor /domain:mydomain.com

  GetDcList failed with error code:  0x800706BA.
  Exiting with error 0x800706BA
  

Progress of sorts.

• DCDIAG ON PDC. There is a "pointer device" exception which is not relevant and will clear.

  Directory Server Diagnosis
  
  Performing initial setup:
     Trying to find home server...
     Home Server = PDC
     * Identified AD Forest.
     Done gathering initial info.
  
  Doing initial required tests
  
     Testing server: Default-First-Site-Name\PDC
        Starting test: Connectivity
           ......................... PDC passed test Connectivity
  
  Doing primary tests
  
     Testing server: Default-First-Site-Name\PDC
        Starting test: Advertising
           ......................... PDC passed test Advertising
        Starting test: FrsEvent
           ......................... PDC passed test FrsEvent
        Starting test: DFSREvent
           ......................... PDC passed test DFSREvent
        Starting test: SysVolCheck
           ......................... PDC passed test SysVolCheck
        Starting test: KccEvent
           ......................... PDC passed test KccEvent
        Starting test: KnowsOfRoleHolders
           ......................... PDC passed test KnowsOfRoleHolders
        Starting test: MachineAccount
           ......................... PDC passed test MachineAccount
        Starting test: NCSecDesc
           ......................... PDC passed test NCSecDesc
        Starting test: NetLogons
           ......................... PDC passed test NetLogons
        Starting test: ObjectsReplicated
           ......................... PDC passed test ObjectsReplicated
        Starting test: Replications
           ......................... PDC passed test Replications
        Starting test: RidManager
           ......................... PDC passed test RidManager
        Starting test: Services
           ......................... PDC passed test Services
        Starting test: SystemLog
    A warning event occurred.  EventID: 0x80000109
                      Time Generated: 07/10/2017   07:15:13
              Event String: A pointer device did not report a valid unit of angular measurement.
           A warning event occurred.  EventID: 0x80000101
              Time Generated: 07/10/2017   07:15:13
              Event String: A pointer device reported a bad angular         physical range.
           ......................... PDC passed test SystemLog
        Starting test: VerifyReferences
           ......................... PDC passed test VerifyReferences
  
  
     Running partition tests on : ForestDnsZones
        Starting test: CheckSDRefDom
           ......................... ForestDnsZones passed test         CheckSDRefDom
        Starting test: CrossRefValidation
           ......................... ForestDnsZones passed test         CrossRefValidation
  
     Running partition tests on : DomainDnsZones
        Starting test: CheckSDRefDom
           ......................... DomainDnsZones passed test         CheckSDRefDom
        Starting test: CrossRefValidation
           ......................... DomainDnsZones passed test         CrossRefValidation
  
     Running partition tests on : Schema
        Starting test: CheckSDRefDom
           ......................... Schema passed test CheckSDRefDom
        Starting test: CrossRefValidation
           ......................... Schema passed test CrossRefValidation
  
     Running partition tests on : Configuration
        Starting test: CheckSDRefDom
           ......................... Configuration passed test         CheckSDRefDom
        Starting test: CrossRefValidation
           ......................... Configuration passed test         CrossRefValidation
  
     Running partition tests on : MYDOMAIN
        Starting test: CheckSDRefDom
           ......................... MYDOMAIN passed test CheckSDRefDom
        Starting test: CrossRefValidation
           ......................... MYDOMAIN passed test CrossRefValidation
  
     Running enterprise tests on : MYDOMAIN.com
        Starting test: LocatorCheck
           ......................... MYDOMAIN.com passed test LocatorCheck
        Starting test: Intersite
           ......................... MYDOMAIN.com passed test Intersite
  

PROBLEM IN SHORT

SonicWall Global VPN client from Windows 10 workstation to PEER NSA 240 reports an error has occurred:

The peer is not responding to phase 1 ISAKMP requests.

VPN CLIENT LOG

The connection has been enabled.
Starting ISAKMP phase 1 negotiation.
An error occured.
The peer is not responding to phase 1 ISAKMP requests.
Starting ISAKMP phase 1 negotiation.
etc...

TESTING CONTEXT

Issue is isolated to windows 10 workstations only from today only. No changes made to NSA peer in prior to failure.

Yesterday 19/11/15 all OS nodes:
- 3 x windows 10
- 4 x windows 8.1
- 6 x windows 7 
Connected without exception.

Today 20/11/15 
- 3 x windows 10 fails with exception above.
- 4 x windows 8.1 operational
- 6 x windows 7 operational

Note this exception is generated before user credentials are entered and on a new install before the pre-shared key is entered.

ATTEMPTED FIXES

• upgrade to latest NSA 240 firmware
• deploy latest version of Global VPN client
• set NSA WAN MTU to 1450 (was 1500)
• Allow packet fragmentation
• disable window firewall on client
• disable windows defender on client
• check windows updates prior / post fail (defender definition only change since 19th)
• tested multiple user
• uninstall vpn client
• Run the GVC Cleaner tool (removes client completely from registry)
• confirmed client credentials used on 10 are operational from windows 8.1
• The 3 x windows 10 clients reporting the exception are completed isolated on seperate networks in home locations, have unique client credentials, 2 share same ADSL exchange but different ISPs. 1 on unique exchange.
• windows 8.1 running laptop plugged into same switch as windows 10 client connects. Rules out any hardware settings between client and peer.
• will also try win 7 VM on windows 10 host (not have time to deploy yet). Pretty sure it will be operational.
• generally reboot on each test.

99.9% certain this is an Windows 10 issue.

VERSION INFORMATION

Dell SonicWall NSA 240 running:
- firmware version Sonic OS Enhanced 5.9.1.1-390
- Safemode verison 5.0.1.11
- ROM version 5.0.2.7


Client Global VPN Client version is:
- GVCSetup64 4.9.9.1016.


Windows 10 version:
- pro 64-bit (10.0, build 10240)

Running out of ideas.

Thank you

Scott

EDITED 25/01/26

A: From a new Windows 10 laptop:

• Connected to a new WIFI network (WIFI X) external to my VPN termination network. For reference ISP is BT. Independent ADSL line.
• Download and deploy GVPN Clinet 4.9.9.1016.
• Entered pre-shared key
• Entered user credentials. Connected.

This is the first Windows 10 successful connection.

B: From same Windows 10 laptop:

• Disconnected VPN.
• Disconnect WIFI
• Connect to another external WIFI network (WIFI Y). Again BT is the ISP, independent ADSL line , note this is not the same ADSL line as WIFI X.
• Attempt VPN connection.
• The peer is not responding to phase 1 ISAKMP requests.

This seems to suggest on a fresh installation of Windows 10 the initial VPN connection is successful.

C: From same Windows 10 laptop:

• Disconnect WIFI Y
• Connect to WIFI X.
• Connect to VPN endpoint.
• Pass user credential.
• Connection is successful.

So the question is why. Please note all other Windows 10 client still fail as per the orginal post.

One thing of note. All successful client connection be it 7 , 8 or 10 all report starting aggressive mode Phase1 exchange. I should point out the VPN termination is behind a NAT device. This has not been an issue until Windows 10. This device has the following support enabled currently:

• PPTP Pass-Through
• IPSec Pass-Through
• Multicast Pass-Through
• Port forwarding 500 UDP
• Port forwarding 4500 UDP

Feel a step closer to resolving this today. In the process of deploying a leased line. I would like to deploy new SonicWall NSA hardware , in this case VPN will terminate on the device hosting the external IPs (ie no NAT). Suspect this will resolve my issues with Windows 10 clients.

Additional Testing

• In addition all ports 1-65534 TCP/UDP have been forwarded to the VPN termination endpoint for testing.

• Anti virus software removed from testing laptop.

• Attempted to change the protocol binding order on the laptop and reboot but did not help. The thinking was Windows 10 is handling something differently in terms of security / bindings so having a look for problems other users are having with comms in general. REF

Thank you. Scott

Current configuration

Windows 2003 server standard edition - domain controller role (nodeB)

Windows 2008 server R2 standard edition - domain controller role (nodeV)

Windows 2008 server (R1) standard edition - exchange server 2007

Windows 2008 server (R1) standard edition - terminal services role

Windows 7 clients

Windows 8.1 clients

Domain function level is Windows 2003 server

Forrest function level is Windows 2003 server

Proposal

The hardware supporting the windows 2003 server domain controller nodeB will be replaced with nodeC below on which 2012 server R2 standard edition will be installed:

PowerEdge R210 II Chassis, 2x3.5" Cabled HDDs, LED Diagnostics

Intel® Core™ Processor I3-3240, 2C/4T, 3.40GHz, 3M cache, 55W TDP

8GB Memory (4x2GB) 1600Mhz

2x1TB, SATA, 3.5-in, 7.2K RPM Hard Drive / RAID 1 with PERC H200

PERC H200 RAID Controller for 3.5" Cabled HD Configuration (compatible with 2012 server)

UEFI BIOS

16X DVD+/-RW ROM Drive SATA with SATA Cable

Questions

Compatibility between the hardware components and server 2012 making up nodeC is confirmed.

Where I need help please is regarding active directory compatibility support with existing servers detailed above and the role out procedures for 2012 DC promotion / demotion of 2003 DC.

• Question 1. With my current configuration in mind any software / OS / domain compatibility issue if adding a 2012 domain controller to this mix ? (domain function level domain/forest remains unchanged at 2003).

• Question 2. Same as question 1 but with the domain/forest function level raised to 2008 ?

• Question 3. Rough roll our procedure:

  • A. deploy Windows 2012 server R2 standard edition on new nodeC.
  • B. add the domain controller role / promote.
  • C. confirm AD replication with existing 2008 DC nodeV
  • D. demote nodeB (2003 DC) and remove from the domain.
  • E. raise domain function level to 2008 server.

Problem:

When opening windows "QUEUE MESSAGES" on windows server 2003 I received the error message

"The list of messages cannot be retrieved. Error: Access is denied"

Why?

Recreated following these steps:

• Windows Server 2003 standard 64-bit
• Right click MY COMPUTER
• Select MANAGE
• SERVICES
• MESSAGE QUEUING
• PRIVATE QUEUE
• MYSERVICE
• QUEUE MESSAGES

Error message displayed:

"The list of messages cannot be retrieved. Error: Access is denied."

Setup/configuration currently deployed:

• Logged in as local administrator.
• Machine is stand alone.
• WCF service is running (using WCF specific user)
• WCF user account is a member of the local ADMIN group.
• dot net 4.0.
• Messing Queueing service is running (local system)
• Maybe a permissions issue creating the error.

PROBLEM

Calling an asp webservice hosted by an ISP from our WCF service hosted on Windows 2008 Server is showing timeout/no response from webservice.

DIAGNOSIS

Using windows network monitor to packet capture and isolate packets sent a webservice i can see:

TLS handshake hello

TCP transmit

TCP retransmit

TCP retransmit

TCP retransmit

TCP retransmit

TCP retransmit

TCP negotionating scale factor

TCP scale factor not supported

This appear to show no response to TCP payload which implies an IP block.

SOLUTION

After contacting the webservice provider they have suggested that no IP block is in place and this issue is specific to Microsoft Windows 2008 Server, dynamic TCP Frame Size and their specific load balancers.

After some further research I believe the below will resolve.

To see the current configuration for the autoTuningLevel parameter, follow these steps:

Click Start

click All Programs, and then click Accessories.

Right-click Command Prompt, and then click Run as Administrator.

If you are prompted for an administrator password or for confirmation, type the password, or clickContinue.

At the command prompt, type the following command, and then press ENTER: netsh interface tcp show global

The value for the autoTuningLevel parameter is listed as Receive Window Auto-Tuning Level.

We would expect this to be set to normal

At the command prompt, type the following command, and then press ENTER: netsh interface tcp set global autotuninglevel=disabled

The following list includes all possible values for the autoTuningLevel parameter:

/disabled: Sets the receive window at the default value.

/highlyrestricted: Lets the receive window grow beyond the default value, but does so very conservatively.

/restricted: Lets the receive window grow beyond the default value, but limits such growth in some scenarios.

/normal: Lets the receive window grow to accommodate most scenarios.

/experimental: Lets the receive window grow to accommodate extreme scenarios.

Note The experimental value may decrease performance in common scenarios. This value should be used only for research purposes.

QUESTION

Simply looking for further information on this problem from an independent source.

Hoping it will be patched by MS at some point.

Thank you Scott

REF: http://support.microsoft.com/kb/935400

ENVIRONMENT

Windows Server 2008 Standard

IIS7

Site1 = asp.net, .net framework 3.5 (2.0) https, IP1 , API, standard ssl certificate

Site2 = asp.net, .net framework 4.0, https, IP2, API, wildcard ssl certificate

Site3 = asp.net, .net framework 4.0, https, IP3, APP, wildcard ssl certificate

Server is set to auto download, install, reboot MS patches.

Please note HTTP to HTTPS redirect is defined in web.config files for SITE2 and SITE3 using this RULE (sorry for poor formatting of XML below):

rewrite

rules

rule name="HTTP to HTTPS redirect" stopProcessing="true"

match url="(.*)" />

conditions

add input="{HTTPS}" pattern="off" ignoreCase="true" /

conditions

action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}{REQUEST_URI}" /

rule

rules

rewrite

I do not think this is related however but added to explain this is why i have not tested access to SITE2 and SITE3 during the outage via HTTP.

PROBLEM

When the server restart access to SITE1 is ok (https).

When the server restart access to SITE2 is no longer available (https).

When the server restart access to SITE3 is no longer available (https).

Please note all other HTTP sites are ok.

All other HTTPS sites using own IPs and .net 2.0 are ok.

SOLUTION

Load IIS7

Select SITES

Select SITE2

Select BINDINGS

Remove BINDING NAME "https , SITE1 host header, 443, IP2"

CLOSE

Restart Site

Select BINDINGS

Add BINDING NAME "https , SITE1 host header, 443, IP2" and select certificate.

CLOSE

SITE is then available again.

Repeat for any other effected sites.

QUESTIONS

I have alerts defined checking each page for availability so its easy to detect, response and resolve this issue .... BUT:

1) Why is it happening ? (only things different between site1 and site 2/3 are the wildcard certificate, the .net4.0 framework, different IPs and the site 2/3 http to https redirect in the web.config file.

2) How can i resolve this or at least diagnose the issue further?

Application and System Event Logs are are not displaying anything of note.

Thanks for any help

Scott

SUMMARY

I have a third party requirement to run an operating system from a remote secured disk. The user is concerned about hard disk security but is not concerned about the risk to the remaining hardware.

At this stage I am not aware which OS they are running or indeed any restrictions on which OS is required so I am looking for a variety of suggestions.

Applications tend not to allow installation over mapped drives so the drive would have to be seen as a local disk i would expect. Again knowing the exact requirements would help sorry.

Obvious things that spring to mind:

1. RDP client to secured/remote terminal services. Altough the user has concerns about graphics peformance. Again i am unable to query the user to understand the application requirements sorry. This point could also include apps like Citrix, GotoMyPC , VNC etc, a dedicated server with an ISP.

2. Parallels. I dont know much about this product but i understand it allow as user to execute an application locally (on MAC but hosted on WINDOWS) without an RDP window (although its over an RDP type connection). App looks like its running on the MAC.

3. 1M sata cable and host drive in a secure/hidden housing external to the PC hardware , floor/wall safe for example. Sounds extreme but user is not too worried about cost.

4. iSCSI or FibreChannel SAN (if money no object) and boot to SAN disk. SAN would be secured/hidden. Drive is seen as a local disk obviously.

5. ChromeOS , all hosted in cloud anyway.

6. If data is the only concern then a varirty of cloud backup solutions are available or local NAS on a RAID array over ETHERNET.

7. Boot from USB stick , could be carried with USER.

8. Employ raid and bolt the machine to a desk ? (or a more elegant PHYSICAL security measure , secure room or specialised hardware for example).

QUESTIONS

Q1. Any product available that allows you to boot an OS from a remote drive over Ethernet ?

Q2. Any other solutions to this issue you can suggest ? .... however radical :)

Sorry about the open ended question , completely understand there are some crucial points that are unknown. Really just trying to find out how many solutions to this problem are available.

Thanks for your time Scott

SUMMARY

Writing a plan to prepare for a 2003 to 2008 active dir upgrade. 2003 AD exists on a single domain controller and has been upgraded to 2003 functionality. I have add a new 2008 Standard R2 server as a member server.

note: Exchange 2007 installed on an additional member server in this 2003 ad domain.

Upgrade plan to date is copied below , i have executed everything fine to date and stopped at ADPREP as i want to ensure the DC is patched and rebooted before proceeding.

Been having a few problems finding enough information for my exact configuration and have been building it peice meal from multiple sources.

This article provided some info , my questions related to what to do after this. Please see below. http://www.winserverhelp.com/2010/05/windows-server-2008-r2-migration-guide-replacing-existing-domain-controllers/

UPGRADE PLAN

0.Backup System state on existing 2003 DC

1.Install 2008 on new server

2.Install DNS and confirm its working

3.Patch server with all updates 2003 & 2008

4.On 2003 upgrade domain level to 2003

5.On 2003 upgarde forrest level to 2003

6.On 2003 Verify Domain and Forest Levels are full Windows Server 2003 and not Mixed/Interim

7.On 2003 regedit \system\currentcontorlset\services\NTDS\parameter (schema version 30 then 44 after adprep)

8.Verify the fsmo roles of all domain controllers. Use netdom /query fsmo

9.Copy adprep directory from Windows 2008 Server Media to 2003DC

10.On 2003 run DCDIAG in cmd to check AD health (all passed)

11.Run adprep to prepare 2003 Active Directory environment for 2008.

-Adprep32.exe /forestprep

-Adprep32.exe /domainprep

-Adprep32.exe /domainprep /gpprep

-Adprep.exe /rodcprep (edited to add this. Have a DMZ so may need a read only DC)

(I understand these can be run during business hours)

note: adprep32.exe used as existing dc is 32 bit and new 2008 server R2 obviously 64 bit

12.Log on to the new server as an admin.

13.Launch the Server Manager.

14.Select the Roles node in the Server Manager.

15.Click Add Roles and then click Next.

16.Select the Active Directory Domain Services checkbox and then click Next. Note that   .NET Framework 3.5.1 is required and  if prompted to install click Add Required Features.

17.Click Next in the Introduction screen.

18.Click Install, this will install the binaries required for the server to become a domain controller.

19.Click Close in the Installation Results screen.

20.In  Server Manager , expand the Roles node and then select the Active Directory Domain Services node.

21.In the Summary section, click  Run the Active Directory Domain Services Installation Wizard (dcpromo.exe).

22.Click Next in the Welcome screen.

23.Select the Existing Forest option.

24.Select  Add a Domain Controller to an Existing Domain   and then click Next.

25.Enter the name of the domain.

26.Click Set to specify alternative credentials to use for the operation.

27.Enter the credentials of a domain admin in the target domain, and then click OK.

28.Click Next.

29.Select the domain for the new domain controller and then click Next.

30.Select a site for the domain and then click Next.

31.Select the Additional Domain Controller Options (these are DNS Server and Global Catalog by default).  Click Next.

32.Click Yes if  a DNS Delegation warning dialog box appears.

33.Select the locations for the log files, database, and the SYSVOL, and then click Next.

34.Enter the Directory Services Restore mode administrator password and  click Next.

35.Review the summary  and  click Next. The   wizard will now create the domain controller and replicate the Active Directory database.

36.Click Finish.

37.Click Restart Now to reboot the new domain controller

QUESTIONS

1)So after the above is done. Do i still need to transfer the FSMO roles to the new 2008 DC or is this completed as part of the upgrade.

2)I would then want to Demote the 2003 server from DC role. Do i use DC promo tool ? this server will remain as a member server.

3)Any other critical points i have missed from this plan above ? exchange prep for example.

Thank you for any advice. Scott

EDITED to explain i plan to demote the existing W2k3 DC hence transferring roles to new DC.

Some good info here too:

http://www.pbbergs.com/windows/articles/Upgrading_Active_Directory_from_2003_to_2008.htm

EDITED TO ADD RODCPREP -Adprep.exe /rodcprep (edited to add this. Have a DMZ so may need a read only DC)

upgrade went without a problem.

On II7 we host a WCF/asp.net based API. In order to allow users of a classic asp application to connect to the API we had to publish a version we refer to as "transport". This Transport version is written in asp.net too, it points to the same assembly , its just the security layer is different to allow classic asp to authenticate. Transport level security is used as opposed to message based security.

When using a browser to load the service reference i can loading the svcutil.exe ... WDSL page.

When using my test asp page to call a web method from this reference i get the following returned:

Finished calling Web Service. Status = Internal Server Error ResponseText = a:InvalidSecurityAn error occurred when verifying security for the message.

This suggests that the authentication is failing. When testing using asp.net or the application WCF storm to contact the normal API everything works well.

The API was recently migrated , it would appear something has not been setup correctly but i am at a loss to explain what.

I can browse to the svcutil.exe ... WDSL service reference, when selecting it via the browser i get the expect XML response.

The USER NAME and password utilised work when using the non-classic asp publicaiton of the API using the message based secuirty.

Would it be possible to post some troubleshooting tip that may help diagnoise the issue please specifically regarding transport level security fault finding and setup ?

Thank you Scott

Afternoon,

I publish an API on domainA.com and have done for several months. *http:/domainA.com/service.svc takes me to the resource (c:\inetput\wwwroot\api) *https://domainA.com/service.svc overnight now cannot connect the same resource.

Web site log file shows error 404 when connecting to https. Browsing to *https://domainA.com/service.svc claims the webpage is not available Log file shows successful connection when using http , log file shows 404 when using https.

The SSL certificate has been installed an working for months , several months to expiry.

I can tenet from a remote pc to domainA 80 and domainA 443 no problem so i know the firewall is fine (log files show connection).

The BINDING shows the correct ports in use 80 and 443.

The IP address (192.168.10.38) is utilised by this web site only.

Months ago i had published a test URL on (192.168.10.38) for testing prior to deployment but this was stopped, the new URL tested and the OLD url (website) deleted sometime ago.

Have tried restarting the problematic site.

Have tried IISreset.

I cannot understand why *https://domainA.com/service.svc overnight now cannot connect the resource the IIS BASIC settings say its pointing too. Port 443 is open and working.

In the process of checking that the IP/443 port is definitely pointing at the same resource as http reference i.e 192.168.10.38 ... but log files confirm connection so it must be fine im sure.

Thank you for any help. Scott

Ref:

IIS7

ASP.net

win 2008 r2

all patched up

I can telnet 192.168.10.10 3389 and get a connection. But RDP client to 192.168.10.10 immedietly bails (less than 1 sec) "connect" button greys briefly, RDP app remains on screen. Have tried these from other nodes on the subnet to 192.168.10.10 with same result.

On 192.168.10.10 Allow Remote Desktop is enabled. On 192.168.10.10 windows firemall is off. I'm connecting from the same subnet, i.e no firewall hardware / routers in the way. AV software is installed but other nodes on same subnet allow RDP connection using exact same AV settings (network group profile) Checked 192.168.10.10 for any additonal AV software or local firewall products. I'm sure none exist. Checked registry to ensure 3389 was the port set for listening.

Seems to be an XP problem (SP3). 2 nodes on the my LAN have this issue, but many others work fine.