当您使用 PEAP MS CHAP v2 作为 802.1 X 连接在 Windows Vista、 Windows XP、 Windows Server 2003,和 Windows 2000 中的身份验证方法时都不会成功的身份验证

文章翻译 文章翻译
文章编号: 904943 - 查看本文应用于的产品
展开全部 | 关闭全部

本文内容

症状

当您作为 802.1 X 连接的身份验证方法使用受保护的可扩展身份验证协议-Microsoft 质询握手身份验证协议版本 2 (PEAP-MS-CHAP-v2) 时,计算机身份验证不会成功。如果计算机身份验证是唯一的身份验证方法,用于建立连接,连接可能不会成功。

原因

当达到过期日期时计算机密码时,Net Logon 服务可能会强制本地计算机凭据到期时计算机处于脱机状态。因此,登录密码不能匹配域控制器上的密码,计算机不能成功进行身份验证。要使用的域控制器,重置密码,计算机必须通过不安全的端口建立网络连接。

替代方法

要变通解决此问题,请使用下列方法之一:

方法 1: 使用计算机和用户身份验证

使用计算机和用户身份验证。虽然计算机身份验证不成功,用户身份验证将建立一个安全的连接。因此,计算机密码被重置。

方法 2: 使用 eap-tls 的 PEAP MS CHAP v2 代替

使用可扩展身份验证协议-传输层安全性 (EAP-TLS),而不是使用 PEAP MS CHAP v2。

更多信息

调用堆栈输出

客户端网络登录日志

06/27 12:51:22 [INIT] Group Policy is not defined for Netlogon
06/27 12:51:22 [INIT] Following are the effective values after parsing
06/27 12:51:22 [INIT]    DBFlag = 0 (0x0)
06/27 12:56:30 [SESSION] DOMAIN: NlChangePassword: Doing it.
06/27 12:56:31 [SESSION] DOMAIN: NlChangePassword: Flag password changed in LsaSecret
06/27 12:56:31 [DNS] Cache: DOMAIN DOMAIN.org.: Found existing domain cache entry
......
06/27 13:00:30 [MISC] NetpDcGetName: DOMAIN similar query failed recently 0
06/27 13:00:30 [CRITICAL] DOMAIN: NlDiscoverDc: Cannot find DC.
06/27 13:00:30 [CRITICAL] DOMAIN: NlSessionSetup: Session setup: cannot pick trusted DC
06/27 13:00:30 [MISC] Eventlog: 5719 (1) "DOMAIN" 0xc000005e c000005e   ^...
06/27 13:00:30 [MISC] DsGetDcName function called: Dom:DOMAIN Acct:(null) Flags: DS BACKGROUND NETBIOS RET_DNS 
06/27 13:00:30 [DNS] Cache: DOMAIN (null): Found existing domain cache entry
06/27 13:00:30 [MISC] NetpDcGetName: DOMAIN similar query failed recently 10
06/27 13:00:30 [MISC] DsGetDcName function returns 1355: Dom:DOMAIN Acct:(null) Flags: DS BACKGROUND NETBIOS RET_DNS 
06/27 13:00:30 [SESSION] DOMAIN: NlSetStatusClientSession: Set connection status to c000005e
06/27 13:00:30 [SESSION] DOMAIN: NlSessionSetup: Session setup Failed
06/27 13:00:30 [INIT] Started successfully
....
06/27 13:16:27 [CRITICAL] NetpDcGetNameNetbios: DOMAIN: Cannot NlBrowserSendDatagram. (1C) 53
06/27 13:16:27 [CRITICAL] NetpDcGetName: DOMAIN: IP and Netbios are both done.
06/27 13:16:27 [CRITICAL] DOMAIN: NlDiscoverDc: Cannot find DC.
06/27 13:16:27 [CRITICAL] DOMAIN: NlGetAnyDCName: Discovery failed c000005e
06/27 13:16:27 [CRITICAL] DsrGetSiteName: NlGetAnyDCName failed. Returning site '(null)' from local cache.
06/27 13:16:27 [MISC] DsGetDcName function called: Dom:(null) Acct:(null) Flags: IP TIMESERV AVOIDSELF BACKGROUND 
06/27 13:16:27 [DNS] Cache: DOMAIN (null): Found existing domain cache entry
06/27 13:16:27 [MISC] NetpDcGetName: DOMAIN similar query failed recently 10
06/27 13:16:27 [MISC] DsGetDcName function returns 1355: Dom:(null) Acct:(null) Flags: IP TIMESERV AVOIDSELF BACKGROUND 
06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E  <==STATUS_NO_LOGON_SERVERS
06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E
06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E
06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E
06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E
06/27 13:16:30 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN
06/27 13:16:30 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E

客户端 RASCHAP 日志

[1116] 06-27 13:23:19:802: ChapBegin(fS=0,bA=0x81)
[1116] 06-27 13:23:19:802: ChapBegin done.
[1116] 06-27 13:23:19:802: ChapMakeMessage,RBuf=00000000
[1116] 06-27 13:23:19:802: ChapCMakeMessage...
[1116] 06-27 13:23:19:802: CS_Initial
[1116] 06-27 13:23:19:802: EapMSChapv2MakeMessage
[1116] 06-27 13:23:19:802: EapMSChapv2CMakeMessage
[1116] 06-27 13:23:19:802: EMV2_Initial
[1116] 06-27 13:23:19:802: ChapMakeMessage,RBuf=000D6CA3
[1116] 06-27 13:23:19:802: ChapCMakeMessage...
[1116] 06-27 13:23:19:802: CS_WaitForChallenge
[1116] 06-27 13:23:19:802: MakeResponseMessage...
[1116] 13:23:19:802: GetChallengeResponse
[1116] 13:23:19:802: RegisterLSA
[1116] 13:23:19:802: GetChallengeResponse Success
[1116] 06-27 13:23:19:802: GetChallengeResponse=0
02 0A 00 4B 31 2D E1 54 DF 84 54 AC D3 2A 19 17 |...K1-.T..T..*..|
D9 C3 19 69 18 00 00 00 00 00 00 00 00 30 83 68 |...i.........0.h|
65 71 F2 D8 B1 F3 62 31 12 FF CF A7 5A C3 BF 48 |eq....b1....Z..H|
00 0E 02 4A FD 00 68 6F 73 74 2F 63 72 65 73 65 |...J..host/crese|
6E 74 2E 62 65 65 72 2E 6F 72 67 00 00 00 00 00 |nt.DOMAIN.org.....|
[1116] 06-27 13:23:19:852: EapMSChapv2MakeMessage
[1116] 06-27 13:23:19:852: EapMSChapv2CMakeMessage
[1116] 06-27 13:23:19:852: EMV2_ResponseSend
[1116] 06-27 13:23:19:852: ChapMakeMessage,RBuf=000D936B
[1116] 06-27 13:23:19:852: ChapCMakeMessage...
[1116] 06-27 13:23:19:852: CS_ResponseSent
[1116] 06-27 13:23:19:852: Message received...
04 0A 00 34 45 3D 36 39 31 20 52 3D 31 20 43 3D |...4E=691 R=1 C=|  <== 691 IS ERROR_AUTHENTICATION_FAILURE
37 46 31 33 34 45 46 36 42 35 35 32 42 36 37 36 |7F134EF6B552B676|
44 44 37 43 43 38 33 31 45 30 32 42 45 41 37 30 |DD7CC831E02BEA70|
20 56 3D 33 00 00 00 00 00 00 00 00 00 00 00 00 | V=3............|
[1116] 06-27 13:23:19:852: GetInfoFromFailure...
[1116] 06-27 13:23:19:852: 'C=' challenge provided,bytes=16...
7F 13 4E F6 B5 52 B6 76 DD 7C C8 31 E0 2B EA 70 |.N..R.v.|.1.+.p|
[1116] 06-27 13:23:19:852: GetInfoFromFailure done,e=691,r=1,v=3
[1116] 06-27 13:23:19:852: Retry :| ex=11 ts=11
[1116] 06-27 13:23:52:879: EapMSChapv2End
[1116] 06-27 13:23:52:879: ChapEnd

服务器网络登录日志

06/27 13:23:20 [MISC] DOMAIN: DsGetDcName function returns 0: Dom:DOMAIN Acct:(null) Flags: DSP NETBIOS RET_DNS 
06/27 13:23:20 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:23:20 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A <==STATUS_WRONG_PASSWORD
06/27 13:23:54 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:23:54 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A
06/27 13:24:24 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:24:24 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A
06/27 13:24:57 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:24:57 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A
06/27 13:25:27 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:25:27 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A
06/27 13:26:00 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered
06/27 13:26:00 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A
06/27 13:26:09 [MISC] DOMAIN: DsGetDcName function called: Dom:DOMAIN.org Acct:(null) Flags: DS BACKGROUND RET_DNS 
06/27 13:26:09 [DNS] NetpDcFindDomainEntry: DOMAIN DOMAIN.org.: Found domain cache entry with quality 2/6
06/27 13:26:09 [DNS] Cache: DOMAIN DOMAIN.org.: Found existing domain cache entry
06/27 13:26:09 [MAILSLOT] Received ping from COMPUTER.DOMAIN.org (null) on <Local>

注意netlogon 服务保留两个密码、 当前和以前的密码。 更改所需的时间当,netlogon 生成一个新的密码、 将当前的密码存储在以前的密码存储区中并将新密码写入当前密码存储区。 此后,它会尝试将推送到 DC 的当前密码。

如果在计算机处于脱机状态,在时间 (或待检等待提出和执行 PEAP 802.1x),它将后,并稍后执行它。但是,新密码 netlogon 被视为当前的密码。这是在当前的密码失败的情况下,它将尝试以前密码的 Netlogon,没问题。 现在与 netlogon 的 802.1x 通信存在的问题是该 802.1x 可以当前只访问当前并不知道 DC 上还在此方案中的密码。

属性

文章编号: 904943 - 最后修改: 2010年3月17日 - 修订: 2.0
这篇文章中的信息适用于:
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows XP Professional Edition
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Server
  • Windows Vista Enterprise
  • Windows Vista Ultimate
  • Windows Vista Home Premium
  • Windows Vista Home Basic
  • Windows Vista Business
  • Windows 7 Enterprise
  • Windows 7 Enterprise N
  • Windows 7 Home Basic
  • Windows 7 Home Premium
  • Windows 7 Home Premium N
  • Windows 7 Professional
  • Windows 7 Professional N
  • Windows 7 Release Candidate
  • Windows 7 Starter
  • Windows 7 Starter N
  • Windows 7 Ultimate
  • Windows 7 Ultimate N
关键字:?
kbmt kbtshoot kbprb KB904943 KbMtzh
机器翻译
注意:这篇文章是由无人工介入的微软自动的机器翻译软件翻译完成。微软很高兴能同时提供给您由人工翻译的和由机器翻译的文章, 以使您能使用您的语言访问所有的知识库文章。然而由机器翻译的文章并不总是完美的。它可能存在词汇,语法或文法的问题,就像是一个外国人在说中文时总是可能犯这样的错误。虽然我们经常升级机器翻译软件以提高翻译质量,但是我们不保证机器翻译的正确度,也不对由于内容的误译或者客户对它的错误使用所引起的任何直接的, 或间接的可能的问题负责。
点击这里察看该文章的英文版: 904943
Microsoft和/或其各供应商对于为任何目的而在本服务器上发布的文件及有关图形所含信息的适用性,不作任何声明。 所有该等文件及有关图形均"依样"提供,而不带任何性质的保证。Microsoft和/或其各供应商特此声明,对所有与该等信息有关的保证和条件不负任何责任,该等保证和条件包括关于适销性、符合特定用途、所有权和非侵权的所有默示保证和条件。在任何情况下,在由于使用或运行本服务器上的信息所引起的或与该等使用或运行有关的诉讼中,Microsoft和/或其各供应商就因丧失使用、数据或利润所导致的任何特别的、间接的、衍生性的损害或任何因使用而丧失所导致的之损害、数据或利润不负任何责任。

提供反馈

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com