Tag: Read-only domain controller

Logons via the Network Policy Server (NPS) fail with reason "Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect."

Assume the following scenario:

  • A certificate-based logon is performed with user or computer accounts to log them on to a wireless (IEEE 802.11 or Wireless LAN) or wired network (IEEE 802.3), or to a remote access connection (e.g. DirectAccess, Routing and Remote Access (RAS), Always on VPN ).
  • As a server for authentication, authorization and accounting (AAA), the company uses the Network Policy Server (NPS) from Microsoft.
  • Logging on to the network is no longer possible.
  • The Network Policy Server logs the following event when a logon attempt is made:
Network Policy Server denied access to a user. [...] Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.
Der Netzwerkrichtlinienserver hat einem Benutzer den Zugriff verweigert. [...] Authentifizierungsfehler aufgrund der Nichtübereinstimmung von Benutzeranmeldeinformationen. Der angegebene Benutzername ist keinem vorhandenen Benutzerkonto zugeordnet, oder das Kennwort war falsch.

Continue reading "Logons via the Network Policy Server (NPS) fail with reason "Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.""

Unable to install Network Device Enrollment Service (NDES) at a site with only read-only domain controllers

Assume the following scenario:

  • A Network Device Enrollment Service (NDES) is to be implemented in the network.
  • Only read-only domain controllers (RODC) are located at the Active Directory site of the NDES server.
  • NDES role configuration fails with the following error message:
Failed to add the following certificate templates to the enterprise Active Directory Certificate Service or update security settings on those templates:
EnrollmentAgentOffline 
CEPEncryption
IPSEC(Offline request)
A referral was returned from the server. 0x8007202b (WIN32:8235 ERROR_DS_REFERRAL)

Continue reading "Unable to install Network Device Enrollment Service (NDES) at a site with only read-only domain controllers"