woensdag 11 mei 2011

Connecting to SMB share on a Windows Server 2003-based computer may not work with CNAME alias "Access denied" or "No network provider accepted the giv

Connecting to SMB share on a Windows Server 2003-based computer may not work with CNAME alias "Access denied" or "No network provider accepted the given network path"
Connecting to SMB share on a Windows Server 2003-based computer may not work with CNAME alias "Access denied" or "No network provider accepted the given network path"

SYMPTOMS

Consider the following scenario. You install Microsoft Windows Server 2003 Service Pack 1 (SP1) on a Windows Server 2003-based computer. After you do this, you experience authentication issues when you try to access a server locally by using its fully qualified domain name (FQDN) or its CNAME alias in the following Universal Naming Convention (UNC) path:

\\servername\sharename
In this scenario, you experience one of the following symptoms:

You receive repeated logon windows.
You receive an "Access denied" error message.
You receive a "No network provider accepted the given network path" error message.
Event ID 537 is logged in the Security event log.
Note You can access the server by using its FQDN or its CNAME alias from another computer in the network other than this computer on which you installed Windows Server 2003 SP1. Additionally, you can access the server on the local computer by using the following paths:

\\IPaddress-of-local-computer
\\Netbiosnameor \\ComputerName
CAUSE

This problem occurs because Windows Server 2003 SP1 includes a new security feature named loopback check functionality. By default, loopback check functionality is turned on in Windows Server 2003 SP1, and the value of the DisableLoopbackCheck registry entry is set to 0 (zero).

Note The loopback check functionality is stored in the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\DisableLoopbackCheck

RESOLUTION

Method 1 (recommended): Create the Local Security Authority host names that can be referenced in an NTLM authentication request
To do this, follow these steps for all the nodes on the client computer:
Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click MSV1_0, point to New, and then click Multi-String Value.
In the Name column, type BackConnectionHostNames, and then press ENTER.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the CNAME or the DNS alias, that is used for the local shares on the computer, and then click OK.

Note Type each host name on a separate line.

Note If the BackConnectionHostNames registry entry exists as a REG_DWORD type, you have to delete the BackConnectionHostNames registry entry.
Exit Registry Editor, and then restart the computer.
Method 2: Disable the authentication loopback check
Re-enable the behavior that exists in Windows Server 2003 by setting the DisableLoopbackCheck registry entry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry subkey to 1. To set the DisableLoopbackCheck registry entry to 1, follow these steps on the client computer:
Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Right-click Lsa, point to New, and then click DWORD Value.
Type DisableLoopbackCheck, and then press ENTER.
Right-click DisableLoopbackCheck, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor.
Restart the computer.
Note You must restart the server for this change to take effect. By default, loopback check functionality is turned on in Windows Server 2003 SP1, and the DisableLoopbackCheck registry entry is set to 0 (zero). The security is reduced when you disable the authentication loopback check, and you open the Windows Server 2003 server for man-in-the-middle (MITM) attacks on NTLM.

MORE INFORMATION

http://support.microsoft.com/?kbid=926642

http://support.microsoft.com/default.aspx?scid=kb;en-us;281308

14 opmerkingen:

Anoniem zei

Usually I don't learn post on blogs, but I would like to say that this write-up very compelled me to check out and do so! Your writing taste has been amazed me. Thanks, very nice post.

Also visit my web blog ... www.jobvargas.com

Anoniem zei

I'm truly enjoying the design and layout of your blog. It's a very easy on the eyes which makes it much
more enjoyable for me to come here and visit more often.
Did you hire out a designer to create your theme? Excellent
work!

Also visit my web page ... diƤt logi

Anoniem zei

Generally I don't read article on blogs, but I wish to say that this write-up very pressured me to check out and do so! Your writing taste has been amazed me. Thank you, quite nice post.

Also visit my page free themes wordpress

Anoniem zei

Piece of writing writing is also a fun, if you know then you can write if not it is complex to write.


Look into my blog post ... tipps blog wordpress

Anoniem zei

Fantastic beat ! I would like to apprentice at the same time as you
amend your web site, how could i subscribe for a weblog
website? The account helped me a applicable deal. I had
been tiny bit familiar of this your broadcast offered shiny clear idea

Here is my website :: the adkins diet

Anoniem zei

I think this is among the most important information for me.
And i am glad reading your article. But should remark on few general things, The site style is perfect, the articles is really excellent :
D. Good job, cheers

Feel free to surf to my web site :: wordpress thems

Anoniem zei

Pretty! This has been a really wonderful article. Thanks for providing this information.


my web site: abnehmen mit low carb

Anoniem zei

Hi there, I check your new stuff daily. Your humoristic style is awesome,
keep it up!

my weblog :: free premium wordpress themes

Anoniem zei

Hi colleagues, how is all, and what you would like to say regarding
this paragraph, in my view its in fact remarkable for me.


Here is my webpage ... steinzeit rezepte

Anoniem zei

This is my first time pay a visit at here and i am actually pleassant to read all at one place.


Look into my blog; kostenlose rezepte ohne gluten
Also see my site: muffins rezepte

Anoniem zei

Keep on working, great job!

Also visit my page ... rosinen paleo
Also see my web page > paleo brot rezept

Anoniem zei

Very nice post. I just stumbled upon your blog and wished to mention that I
have really enjoyed browsing your blog posts.
After all I will be subscribing in your feed and I am hoping you write
again very soon!

Feel free to surf to my blog; glyx brot

Anoniem zei

Wow, fantastic blog layout! How long have you been blogging for?
you made blogging look easy. The overall look of your
web site is fantastic, let alone the content!


Here is my web site: arbeitszimmer absetzen

Anoniem zei

Ahaa, its nice discussion on the topic of this piece
of writing here at this weblog, I have read all that,
so at this time me also commenting at this place.

Here is my webpage; download software