Tim
2009-04-02 14:25:01 UTC
I have 8 VPN users authenticating through a CheckPoint firewall over RADIUS
to one of 2 IAS Servers both of which are domain controllers. Simply put
when people succeed and 7 of them do, the following or similar message gets
put in the system log of the IAS server...
"Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 3/17/2009
Time: 10:46:50 AM
User: N/A
Computer: PDC Emulator & IAS Server computer name
Description:
User jonesm was granted access.
Fully-Qualified-User-Name = internal.domainname/Users/Margaret Jones
NAS-IP-Address = 192.168.102.1
NAS-Identifier = <not present>
Client-Friendly-Name = Firewall Host Name
Client-IP-Address = 192.168.100.252
Calling-Station-Identifier = <not present>
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Our Standard RADIUS Policy
Authentication-Type = MS-CHAPv2
EAP-Type = <undetermined>
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00"
Note the Fully-Qualified-User-Name and correct Policy-Name being present.
The user name smells like DNS being resolved and this makes sense to me.
Now here's what happens to the one user that has 50% success and 50% failure.
"Event Type: Warning
Event Source: IAS
Event Category: None
Event ID: 2
Date: 3/16/2009
Time: 7:43:09 PM
User: N/A
Computer: Same PDC emulator and IAS server computer name
Description:
User doed was denied access.
Fully-Qualified-User-Name = domainnetbiosname\doed
NAS-IP-Address = 192.168.102.1
NAS-Identifier = <not present>
Called-Station-Identifier = <not present>
Calling-Station-Identifier = <not present>
Client-Friendly-Name = Firewall Host Name
Client-IP-Address = 192.168.100.252
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = <undetermined>
Authentication-Type = MS-CHAPv2
EAP-Type = <undetermined>
Reason-Code = 36
Reason = The user account is currently locked and cannot be authenticated.
Only a person with administrative rights for either the computer or the
domain can unlock the user account.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 75 07 07 80"
Note the netbios resolution and lack of Policy Name. Why in the world would
this happen? No they are not really locked out. The message is absolutely
LYING! Thoughts?
to one of 2 IAS Servers both of which are domain controllers. Simply put
when people succeed and 7 of them do, the following or similar message gets
put in the system log of the IAS server...
"Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 3/17/2009
Time: 10:46:50 AM
User: N/A
Computer: PDC Emulator & IAS Server computer name
Description:
User jonesm was granted access.
Fully-Qualified-User-Name = internal.domainname/Users/Margaret Jones
NAS-IP-Address = 192.168.102.1
NAS-Identifier = <not present>
Client-Friendly-Name = Firewall Host Name
Client-IP-Address = 192.168.100.252
Calling-Station-Identifier = <not present>
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Our Standard RADIUS Policy
Authentication-Type = MS-CHAPv2
EAP-Type = <undetermined>
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00"
Note the Fully-Qualified-User-Name and correct Policy-Name being present.
The user name smells like DNS being resolved and this makes sense to me.
Now here's what happens to the one user that has 50% success and 50% failure.
"Event Type: Warning
Event Source: IAS
Event Category: None
Event ID: 2
Date: 3/16/2009
Time: 7:43:09 PM
User: N/A
Computer: Same PDC emulator and IAS server computer name
Description:
User doed was denied access.
Fully-Qualified-User-Name = domainnetbiosname\doed
NAS-IP-Address = 192.168.102.1
NAS-Identifier = <not present>
Called-Station-Identifier = <not present>
Calling-Station-Identifier = <not present>
Client-Friendly-Name = Firewall Host Name
Client-IP-Address = 192.168.100.252
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = <undetermined>
Authentication-Type = MS-CHAPv2
EAP-Type = <undetermined>
Reason-Code = 36
Reason = The user account is currently locked and cannot be authenticated.
Only a person with administrative rights for either the computer or the
domain can unlock the user account.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 75 07 07 80"
Note the netbios resolution and lack of Policy Name. Why in the world would
this happen? No they are not really locked out. The message is absolutely
LYING! Thoughts?