External RDWeb Access generates two RDP sessions in RDS Farm and other problems
i'm having problem logins rdwa/rdg setup internal farm. using san cert , farm named cert, digitally signed remoteapp mstsc.exe using farm name cert arguments topoint ot rds farm name , use public mode, domain name same inside outside, using nla, rdp client 7.0 , web sso.
internally, no issues. externally, no issues following exceptions.
using rd web access rd gateway, user accounts attempting log onto rds farm internet have 2 sessions different rds farm servers.
upon logout, 1 remain in disconnected state (until ide/disconnected timeout threshold reached: 30 minutes company policy).
happens every time.
intermittent issues happen during second logon prompt comes when published mstsc.exe remoteapp used (full desktop desired policy):
#1 during second logon , monitoring remote desktop connection manager, see rds farm user accoutn session #1 active in remote desktop connection manager farm, logon prompt , attempt logon. if successful, when see 2 rdp sessions on 2 separate rds farm servers. go properties of computer , see server on (always second session during successful logon). single session enabled.
"your credentials did not work. credentials used connect <fqdn of farm name> did not work." credentials correct. if cancel logon attempt, first rdp session remains in rdcm disconnected.
following chain of events on rds farm server event logs see following:
in terminalservices-session broker log:
event 1301 on first server of rds farm:
remote desktop connection broker client received request redirection.
user : "the domain\username goes here"
rdp client version : 4
followed by:
in terminalservices-session broker log:
event 1307 on first server of rds farm:
remote desktop connection broker client redirected user "the domain\username goes here" endpoint "internal fqdn of second rds farm server name goes here".
ip address of end point = "internal ip address of second internal rds farm server here"
here second logon prompt presented.
i see following error in security event logs on server of first rdp session in rdcb logon process:
log name: security
source: microsoft-windows-security-auditing
date: 1/6/2011 4:17:41 pm
event id: 4625
task category: logon
level: information
keywords: audit failure
user: n/a
computer: "internal fqdn server name goes here"
description:
account failed log on.
subject:
security id: null sid
account name: -
account domain: -
logon id: 0x0
logon type: 3
account logon failed:
security id: null sid
account name: "the username goes here"
account domain: "the netbios domain name goes here"
failure information:
failure reason: error occured during logon.
status: 0xc000006d
sub status: 0x0
process information:
caller process id: 0x0
caller process name: -
network information:
workstation name: "the netbios name goes here"
source network address: -
source port: -
detailed authentication information:
logon process:
authentication package: ntlm
transited services: -
package name (ntlm only): -
key length: 0
this event generated when logon request fails. generated on computer access attempted.
the subject fields indicate account on local system requested logon. commonly service such server service, or local process such winlogon.exe or services.exe.
the logon type field indicates kind of logon requested. common types 2 (interactive) , 3 (network).
the process information fields indicate account , process on system requested logon.
the network information fields indicate remote logon request originated. workstation name not available , may left blank in cases.
the authentication information fields provide detailed information specific logon request.
- transited services indicate intermediate services have participated in logon request.
- package name indicates sub-protocol used among ntlm protocols.
- key length indicates length of generated session key. 0 if no session key requested.
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<system>
<provider name="microsoft-windows-security-auditing" guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<eventid>4625</eventid>
<version>0</version>
<level>0</level>
<task>12544</task>
<opcode>0</opcode>
<keywords>0x8010000000000000</keywords>
<timecreated systemtime="2011-01-06t21:17:41.613504800z" />
<eventrecordid>157271</eventrecordid>
<correlation />
<execution processid="496" threadid="676" />
<channel>security</channel>
<computer>"internal fqdn server name goes here"</computer>
<security />
</system>
<eventdata>
<data name="subjectusersid">s-1-0-0</data>
<data name="subjectusername">-</data>
<data name="subjectdomainname">-</data>
<data name="subjectlogonid">0x0</data>
<data name="targetusersid">s-1-0-0</data>
<data name="targetusername">"the username goes here"</data>
<data name="targetdomainname">"the netbios domain name goes here"</data>
<data name="status">0xc000006d</data>
<data name="failurereason">%%2304</data>
<data name="substatus">0x0</data>
<data name="logontype">3</data>
<data name="logonprocessname">
</data>
<data name="authenticationpackagename">ntlm</data>
<data name="workstationname">"the netbios name goes here"</data>
<data name="transmittedservices">-</data>
<data name="lmpackagename">-</data>
<data name="keylength">0</data>
<data name="processid">0x0</data>
<data name="processname">-</data>
<data name="ipaddress">-</data>
<data name="ipport">-</data>
</eventdata>
</event>
on rdcb security event log see following:
log name: security
source: microsoft-windows-security-auditing
date: 1/6/2011 4:17:41 pm
event id: 4771
task category: kerberos authentication service
level: information
keywords: audit failure
user: n/a
computer: "rdcb fqdn goes here"
description:
kerberos pre-authentication failed.
account information:
security id: "domain\username goes here"
account name: "username goes here"
service information:
service name: krbtgt/"internal domain name goes here"
network information:
client address: ::ffff:192.168.5.44
client port: 56032
additional information:
ticket options: 0x40810010
failure code: 0x18
pre-authentication type: 2
certificate information:
certificate issuer name:
certificate serial number:
certificate thumbprint:
certificate information provided if certificate used pre-authentication.
pre-authentication types, ticket options , failure codes defined in rfc 4120.
if ticket malformed or damaged during transit , not decrypted, many fields in event might not present.
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<system>
<provider name="microsoft-windows-security-auditing" guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<eventid>4771</eventid>
<version>0</version>
<level>0</level>
<task>14339</task>
<opcode>0</opcode>
<keywords>0x8010000000000000</keywords>
<timecreated systemtime="2011-01-06t21:17:41.616400000z" />
<eventrecordid>8495757</eventrecordid>
<correlation />
<execution processid="488" threadid="3108" />
<channel>security</channel>
<computer>"rdcb fqdn goes here"</computer>
<security />
</system>
<eventdata>
<data name="targetusername">"username goes here"</data>
<data name="targetsid">s-1-5-21-1708537768-1844823847-1417001333-7135</data>
<data name="servicename">krbtgt/"internal domain name goes here"</data>
<data name="ticketoptions">0x40810010</data>
<data name="status">0x18</data>
<data name="preauthtype">2</data>
<data name="ipaddress">::ffff:"internal ipv4 address goes here"</data>
<data name="ipport">56032</data>
<data name="certissuername">
</data>
<data name="certserialnumber">
</data>
<data name="certthumbprint">
</data>
</eventdata>
</event>
#2 intermittent problem number error sometimes:
'this computer can't connect remote computer. remote computer <farm name> trying connect redirecting remote computer <server name> remote desktop connection cannot verify 2 computers belong same farm"
haaalppp!! i'm stumped!!
hi,
according description, same sid or have long character in user name lead problem. please refer following steps:
1. users cannot logon remote desktop session host through remote desktop, error : account failed log on : event id 4625
cause: using long user names logon server.
resolution: use short names.
additional information:
samaccountname . domain-wide uniqueness, without replication latency, 20-character limit user objects (not groups).
http://technet.microsoft.com/en-us/library/cc961578.aspx
the samaccountname attribute user’s login id.
http://technet.microsoft.com/en-us/library/cc773309(ws.10).aspx
2. whether domain controller upgraded windows 2003 windows 2008 r2?
if user accounts existed before domain upgraded windows server 2003, terminal server license servers group might missing in access control list (acl) of user objects in active directory. or group in acl not have permissions update terminal services licensing information user account.
resolution: using delegate control wizard add permissions add read\write permissions "terminal server license server” attribute of “user object” terminal server license servers group.
3. do use cloning images deploy operating system?
if yes, need ran sysprep on host machine , collected , deployed image on other servers.
technology changes life……
Windows Server > Remote Desktop Services (Terminal Services)
Comments
Post a Comment