[awalt]

Is there an x64 version that works with Win Srv 2008 R2?

Looks like nice work so far!!

[awalt]

FIXED IT!!!

Here is what I did – I removed the computer from the domain. I then went in and did what you said, especially turning off Password-protected sharing. Went back and joined the domain, and even though that entry never shows anywhere, the logon failure is gone! This actually sounds like a big to me, it must be turned on by default and even though it’s WinSrv 2008 in a domain somebody is looking at that value.

I have been trying for 10 minutes to make it happen and I can’t.

Thanks SO MUCH for your help, I’ll update if anything changes in the next few days.

[awalt]

Leaving domain to try this, maybe something is messed up on the local part. Stay tuned..

[awalt]

I did the net user guest /active:NO

However,
Turn On Network Discovery — was already On
Turn On File and Print Sharing — was already on
Turn Off Password-protected sharing – doesn’t exist for me on that screen! Article “Enable or disable sharing and discovery” on technet.microsoft.com says it’s for non-domain use only. It also says “To grant access to a shared folder on this computer on another computer, you must create a user name and password on this computer and supply them to the other user…”

[awalt]

Yes, 4625. Here is a sample of a latest one (domain name and account name changed to protect the innocent):

An account failed to log on.

Subject:
Security ID: DomainNameDOM
Account Name: DOM
Account Domain: DomainName
Logon ID: 0x291404

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Guest
Account Domain: WILDCAT

Failure Information:
Failure Reason: Account currently disabled.
Status: 0xc000006e
Sub Status: 0xc0000072

Process Information:
Caller Process ID: 0xe08
Caller Process Name: C:Windowsexplorer.exe

Network Information:
Workstation Name: WILDCAT
Source Network Address: –
Source Port: –

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: –
Package Name (NTLM only): –
Key Length: 0

[awalt]

Well I turned off file and printer sharing, and Public folder sharing, and the error continues. It’s not that…

[awalt]

It almost feels like it is some sort of simple file sharing, but that doesn’t exist in Win Server 2K8.

[awalt]

When I boot into safe with networking and bring up Devices and Printers (note this computer is part of the domain again, but I logged in as the local Built In Administrator), there is only a devices section, no printers section. The printer is there, but it has a little yellow triangle with an exclamation box, and hovering over it says troubleshooting necessary. Must have to do with safe mode. Right clicking on it/Properties did not give me a security tab, it had a General Tab and a Hardware tab, that one had a list of all system devices. I couldn’t see anywhere to get the Permissions info on this page or in Devices and Printers.

I created the local account TempAdmin as an administrator. I logged in, cleared the event log, and brought up Windows explorer. I just clicked around some folders, and refreshed Event Log. I had 8 audit failures, login failures, the subject user name was TempAdmin, the target user name was Guest!

[awalt]

I rejoined the domain to get some work done. Should I be in the domain or still in the workgroup?

[awalt]

Thanks for the suggestions! Here is what I found:

The accounts under c:WINDOWS, explorer.exe and printui.exe all look the same as yours except my domain name in lieu of SEALY1986. Where does it say who the current owner is? I did not see that, but I suspect it’s ok (I’d be happy to check it again though).

Now – I took the offending Win2K8 R2 box out of the domain, put it in WORKGROUP (should be only PC in that group). Just as a lark, I tested, and I get the same logon audit failure on Guest in explorer.exe! So it has nothing to do with domain/domain settings.

Does that generate any ideas? I’ll keep looking too.

[awalt]

Thanks again for the help!

FYI Wildcat is the offending 2K8 R2 computer, not the domain name…

I have a linked GPO, so I made sure the change was in there. It shows up under the domain name, and its link order is #1 above the default domain policy. I assume that is correct?

The setting you told me about was not defined, I set it to the “Classic” setting.

My user account is a Domain and Enterprise Admin in Active Directory, as well as an Admin on the offending computer local account.

I then logged off and logged back on, and the same attempt to logon as Guest occurs.

Thanks again for helping me look at this!

[awalt]

Thanks for your help? How do I change/examine this on the Domain Controller? This has changed a lot since I last looked at it on the DC side…

PS yes I am on a domain…

[awalt]

Thanks for the reply! I checked it, it’s set to “Classic – local users authenticate as themselves”.

If you have any other ideas or hunches please let me know, as I am out of ideas. Thanks for your time!

[awalt]

Was this installed on a PC that ran 2008 ? I am wondering if the performance is as good, I got concerned in using it as a workstation when I saw SuperFetch was not a service any more in R2…

[awalt]

I am sticking with Server, the biggest reason being Hyper-V. I really like being able to run beta software or certain Dev tools in a VM. It’s amazing how much more stable my system has become once the basic system does not have new installs coming and going alll the time.

[Author]

Posts