RDP Authentication issues Windows 2008 R2

Today we had a nasty encounter with sudden access denied on RDP connection to our Terminal Server Farms.

The day started that users could not connect to our Navision environment, this environment constists of an Terminal Server farm with an SQL 2008 Cluster. After analyzing first symptoms we saw that the SQL Cluster had failed over but that the quorum disk was stil on the Node that had "sudden" issues.

Thus we gracefully brought the faulty node down through Cluster Manager and started it up again.
In the meantime we were notified that there were still issues, then we saw profile redirection errors caused by a faulty location and permissions of the user profile location. We left the profiles at default location and focussed on the permissions we fixed them, and users started to report that they could log in again.

But now problems started to appear out of now where users could not connect to our other Terminal Servers farms for other application, we where now more then 3 hours after the initial problems appeared.
While trying to find several causes for these issues we focused on the first symptoms that were reported, we should not have done that but that is with hindsight.


We focussed on Kerberos issues because we have a mixed 2003 and 2008 forest and 50 domains, we sometimes run into the infamous KDC ticket being to large. We now set it to 48000 as per microsoft recommendation for windows 2012 with its base http encoding that it no longer can be set at its largest dword value it can take.
Read this for Kerberos changes in 2012 it will save you in large environments.
http://technet.microsoft.com/en-us/library/hh831747.aspx

But we came to the conclusion it was not the rootcause, simultaniously we started to suspect group policy changes but checking the change date for all applied policies ruled that out rather quickly.

After pinpointing the problems to a single datacenter we realized what just had happened, it was the BlueCoat that was causing the problems, the day before it was put back in service after former issues.

Bypassing the Bluecoat solved the issues.....

pwhmmmmwwwwweeh.. what a day in the office

Comments

Post a Comment

Popular posts from this blog

Exchange Server Error -1018: How Microsoft IT Recovers Damaged Exchange Databases

Image
I found this paper on the showcase site from microsoft I hope it is of help to you. It sure helped me!     Technical White Paper Published: August 1, 2005 Executive Summary Error –1018 (JET_errReadVerifyFailure) is a familiar—and dreaded—error in Microsoft® Exchange Server. It indicates that an Exchange database file has been damaged by a failure or problem in the underlying file system or hardware. This paper explains the conditions that result in error –1018. It also covers the detection mechanisms that Exchange uses to discover and recover from damage to its database files. The Microsoft Information Technology group (Microsoft IT) runs one of the most extensive Exchange Server organizations in the world. Exchange administrators at Microsoft have investigated and recovered from dozens of –1018 error problems. This paper shows you how Microsoft IT monitors fo
Read more

Server and Domain Isolation Using IPsec and Group Policy

Image
Microsoft Solutions for Security and Compliance Server and Domain Isolation Using IPsec and Group Policy © 2006 Microsoft Corporation. This work is licensed under the Creative Commons Attribution-NonCommercial License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA. Table of Contents Chapter 1: Introduction to Server and Domain Isolation. 1 Executive Summary. 1 Who Should Read This Guide. 2 The Business Challenge. 3 The Business Benefits. 3 The Technology Challenge. 4 Creating a Project Team.. 6 Guide Overview.. 7 Chapter 1: Introduction to Server and Domain Isolation. 7 Chapter 2: Understanding Server and Domain Isolation. 7 Chapter 3: Determining the Current State of Your IT Infrastructure. 7 Chapter 4: Designing and Planning Isolation Groups. 8 Chapter 5: Creating IPsec Policies for Isolation Groups.
Read more

[Solved] The Group Policy client-side extension Internet Explorer Zonemapping failed to execute

Image
I had the error below in my application eventlog.     Event Type:    Error Event Source:    Userenv Event Category:    None Event ID:    1085 Date:        30-09-2008 Time:        15:20:30 User:        NT AUTHORITY\SYSTEM Computer:    TBG-TS01 Description: The Group Policy client-side extension Internet Explorer Zonemapping failed to execute. Please look for any errors reported earlier by that extension. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp .   My problem was with my site to zone assignment list I used a wildcard like this: “ *microsoft.com ” but what you need to do is this “ *.microsoft.com ” So it is safe to say that the documentation from microsoft needs some sort of an update stating that you can only use a wildcard infront of dot. Below is the microsoft explaination:   This policy setting allows you to manage a list of sites that you want to associate with a particular s
Read more