Dear Paul,
Paul Derwent wrote:
> With regards to the question I asked last week (see below), I have looked
> at the event log, which contains the following message:
> 
> =============Beginning of BD-w2k-test02 event log=========================
> ===========
> Date: 3/20/02            Source:  Security
> Time:  12:24             Category:  Login/Logoff
> Type: Failure            Event ID: 529
> User:  NT Authority\System
> Computer: BD-W2k-test02
> 
> Logon Failure:
> Reason:        Unknown user name or bad password
> User Name:    derwent
> Domain:        FERMITEST
> Logon Type:    3
> Logon Process:    NtLmSsp
> Authentication Package:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name:    \\G4DERWENT
> 
> =============End of BD-w2k-test02 event log===============================
> ===========
> 
> In talking with our Windows system administrator, he interprets it as a NTLMv1
> access attempt (we have verified the username and password from a W2K system
> to be correct).  Is there anything else I can check on my end?

Sharity offers LM and NTLMv1 authentication to the server. Your event log
entry suggests that the server has chosen NTLMv1.

I assume that you have verified the user name and password AND the domain
name. If all are correct, I can come up with only one theory: Since Sharity
offers LM and NTLM, servers have always used LM instead of NTLM. A bug in
Sharity's NTLM part would therefore have never been found. Only if a server
rejects LM, the NTLM part becomes relevant.

You could verify this hypothesis by checking whether your server allows LM
authentication. If it does not, enable it and see whether Sharity can
connect. If yes, I guess we have something to do....

Regards, Christian.

PS: A good technical article about Windows authentication and the various
registry settings can be found at http://rr.sans.org/win2000/audit_w2k.php.

--
Dipl.-Ing. Christian Starkjohann
Objective Development
mailto:[EMAIL PROTECTED] | http://www.obdev.at/


_______________________________________________
Sharity-talk mailing list
[EMAIL PROTECTED]
To unsubscribe see http://at.obdev.at/mailman/listinfo/sharity-talk

Reply via email to