当您使用 PEAP MS CHAP v2 作为 802.1 X 连接在 Windows Vista、 Windows XP、 Windows Server 2003,和 Windows 2000 中的身份验证方法时都不会成功的身份验证

针对 Windows XP 的支持已终止

Microsoft 已于 2014 年 4 月 8 日终止了针对 Windows XP 的支持。该更改已影响到您的软件更新和安全选项。 了解这一措施对于您的含义以及如何继续保持受保护状态。

针对 Windows Server 2003 的支持已于 2015 年 7 月 14 日终止。

Microsoft 已于 2015 年 7 月 14 日终止了对于 Windows Server 2003 的支持。该更改已影响到您的软件更新和安全选项。 了解这一措施对于您的含义以及如何继续保持受保护状态。

注意:这篇文章是由无人工介入的微软自动的机器翻译软件翻译完成。微软很高兴能同时提供给您由人工翻译的和由机器翻译的文章, 以使您能使用您的语言访问所有的知识库文章。然而由机器翻译的文章并不总是完美的。它可能存在词汇,语法或文法的问题,就像是一个外国人在说中文时总是可能犯这样的错误。虽然我们经常升级机器翻译软件以提高翻译质量,但是我们不保证机器翻译的正确度,也不对由于内容的误译或者客户对它的错误使用所引起的任何直接的, 或间接的可能的问题负责。

点击这里察看该文章的英文版: 904943
症状
当您作为 802.1 X 连接的身份验证方法使用受保护的可扩展身份验证协议-Microsoft 质询握手身份验证协议版本 2 (PEAP-MS-CHAP-v2) 时,计算机身份验证不会成功。如果计算机身份验证是唯一的身份验证方法,用于建立连接,连接可能不会成功。
原因
当达到过期日期时计算机密码时,Net Logon 服务可能会强制本地计算机凭据到期时计算机处于脱机状态。因此,登录密码不能匹配域控制器上的密码,计算机不能成功进行身份验证。要使用的域控制器,重置密码,计算机必须通过不安全的端口建立网络连接。
替代方法
要变通解决此问题,请使用下列方法之一:

方法 1: 使用计算机和用户身份验证

使用计算机和用户身份验证。虽然计算机身份验证不成功,用户身份验证将建立一个安全的连接。因此,计算机密码被重置。

方法 2: 使用 eap-tls 的 PEAP MS CHAP v2 代替

使用可扩展身份验证协议-传输层安全性 (EAP-TLS),而不是使用 PEAP MS CHAP v2。
更多信息

调用堆栈输出

客户端网络登录日志

06/27 12:51:22 [INIT] Group Policy is not defined for Netlogon06/27 12:51:22 [INIT] Following are the effective values after parsing06/27 12:51:22 [INIT]    DBFlag = 0 (0x0)06/27 12:56:30 [SESSION] DOMAIN: NlChangePassword: Doing it.06/27 12:56:31 [SESSION] DOMAIN: NlChangePassword: Flag password changed in LsaSecret06/27 12:56:31 [DNS] Cache: DOMAIN DOMAIN.org.: Found existing domain cache entry......06/27 13:00:30 [MISC] NetpDcGetName: DOMAIN similar query failed recently 006/27 13:00:30 [CRITICAL] DOMAIN: NlDiscoverDc: Cannot find DC.06/27 13:00:30 [CRITICAL] DOMAIN: NlSessionSetup: Session setup: cannot pick trusted DC06/27 13:00:30 [MISC] Eventlog: 5719 (1) "DOMAIN" 0xc000005e c000005e   ^...06/27 13:00:30 [MISC] DsGetDcName function called: Dom:DOMAIN Acct:(null) Flags: DS BACKGROUND NETBIOS RET_DNS 06/27 13:00:30 [DNS] Cache: DOMAIN (null): Found existing domain cache entry06/27 13:00:30 [MISC] NetpDcGetName: DOMAIN similar query failed recently 1006/27 13:00:30 [MISC] DsGetDcName function returns 1355: Dom:DOMAIN Acct:(null) Flags: DS BACKGROUND NETBIOS RET_DNS 06/27 13:00:30 [SESSION] DOMAIN: NlSetStatusClientSession: Set connection status to c000005e06/27 13:00:30 [SESSION] DOMAIN: NlSessionSetup: Session setup Failed06/27 13:00:30 [INIT] Started successfully....06/27 13:16:27 [CRITICAL] NetpDcGetNameNetbios: DOMAIN: Cannot NlBrowserSendDatagram. (1C) 5306/27 13:16:27 [CRITICAL] NetpDcGetName: DOMAIN: IP and Netbios are both done.06/27 13:16:27 [CRITICAL] DOMAIN: NlDiscoverDc: Cannot find DC.06/27 13:16:27 [CRITICAL] DOMAIN: NlGetAnyDCName: Discovery failed c000005e06/27 13:16:27 [CRITICAL] DsrGetSiteName: NlGetAnyDCName failed. Returning site '(null)' from local cache.06/27 13:16:27 [MISC] DsGetDcName function called: Dom:(null) Acct:(null) Flags: IP TIMESERV AVOIDSELF BACKGROUND 06/27 13:16:27 [DNS] Cache: DOMAIN (null): Found existing domain cache entry06/27 13:16:27 [MISC] NetpDcGetName: DOMAIN similar query failed recently 1006/27 13:16:27 [MISC] DsGetDcName function returns 1355: Dom:(null) Acct:(null) Flags: IP TIMESERV AVOIDSELF BACKGROUND 06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E  <==STATUS_NO_LOGON_SERVERS06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E06/27 13:16:29 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:29 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E06/27 13:16:30 [SESSION] I_NetLogonGetAuthData: (null) DOMAIN06/27 13:16:30 [CRITICAL] I_NetLogonGetAuthData: DOMAIN: failed C000005E

客户端 RASCHAP 日志

[1116] 06-27 13:23:19:802: ChapBegin(fS=0,bA=0x81)[1116] 06-27 13:23:19:802: ChapBegin done.[1116] 06-27 13:23:19:802: ChapMakeMessage,RBuf=00000000[1116] 06-27 13:23:19:802: ChapCMakeMessage...[1116] 06-27 13:23:19:802: CS_Initial[1116] 06-27 13:23:19:802: EapMSChapv2MakeMessage[1116] 06-27 13:23:19:802: EapMSChapv2CMakeMessage[1116] 06-27 13:23:19:802: EMV2_Initial[1116] 06-27 13:23:19:802: ChapMakeMessage,RBuf=000D6CA3[1116] 06-27 13:23:19:802: ChapCMakeMessage...[1116] 06-27 13:23:19:802: CS_WaitForChallenge[1116] 06-27 13:23:19:802: MakeResponseMessage...[1116] 13:23:19:802: GetChallengeResponse[1116] 13:23:19:802: RegisterLSA[1116] 13:23:19:802: GetChallengeResponse Success[1116] 06-27 13:23:19:802: GetChallengeResponse=002 0A 00 4B 31 2D E1 54 DF 84 54 AC D3 2A 19 17 |...K1-.T..T..*..|D9 C3 19 69 18 00 00 00 00 00 00 00 00 30 83 68 |...i.........0.h|65 71 F2 D8 B1 F3 62 31 12 FF CF A7 5A C3 BF 48 |eq....b1....Z..H|00 0E 02 4A FD 00 68 6F 73 74 2F 63 72 65 73 65 |...J..host/crese|6E 74 2E 62 65 65 72 2E 6F 72 67 00 00 00 00 00 |nt.DOMAIN.org.....|[1116] 06-27 13:23:19:852: EapMSChapv2MakeMessage[1116] 06-27 13:23:19:852: EapMSChapv2CMakeMessage[1116] 06-27 13:23:19:852: EMV2_ResponseSend[1116] 06-27 13:23:19:852: ChapMakeMessage,RBuf=000D936B[1116] 06-27 13:23:19:852: ChapCMakeMessage...[1116] 06-27 13:23:19:852: CS_ResponseSent[1116] 06-27 13:23:19:852: Message received...04 0A 00 34 45 3D 36 39 31 20 52 3D 31 20 43 3D |...4E=691 R=1 C=|  <== 691 IS ERROR_AUTHENTICATION_FAILURE37 46 31 33 34 45 46 36 42 35 35 32 42 36 37 36 |7F134EF6B552B676|44 44 37 43 43 38 33 31 45 30 32 42 45 41 37 30 |DD7CC831E02BEA70|20 56 3D 33 00 00 00 00 00 00 00 00 00 00 00 00 | V=3............|[1116] 06-27 13:23:19:852: GetInfoFromFailure...[1116] 06-27 13:23:19:852: 'C=' challenge provided,bytes=16...7F 13 4E F6 B5 52 B6 76 DD 7C C8 31 E0 2B EA 70 |.N..R.v.|.1.+.p|[1116] 06-27 13:23:19:852: GetInfoFromFailure done,e=691,r=1,v=3[1116] 06-27 13:23:19:852: Retry :| ex=11 ts=11[1116] 06-27 13:23:52:879: EapMSChapv2End[1116] 06-27 13:23:52:879: ChapEnd

服务器网络登录日志

06/27 13:23:20 [MISC] DOMAIN: DsGetDcName function returns 0: Dom:DOMAIN Acct:(null) Flags: DSP NETBIOS RET_DNS 06/27 13:23:20 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:23:20 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A <==STATUS_WRONG_PASSWORD06/27 13:23:54 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:23:54 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A06/27 13:24:24 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:24:24 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A06/27 13:24:57 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:24:57 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A06/27 13:25:27 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:25:27 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A06/27 13:26:00 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Entered06/27 13:26:00 [LOGON] DOMAIN: SamLogon: Network logon of DOMAIN\COMPUTER$ from  Returns 0xC000006A06/27 13:26:09 [MISC] DOMAIN: DsGetDcName function called: Dom:DOMAIN.org Acct:(null) Flags: DS BACKGROUND RET_DNS 06/27 13:26:09 [DNS] NetpDcFindDomainEntry: DOMAIN DOMAIN.org.: Found domain cache entry with quality 2/606/27 13:26:09 [DNS] Cache: DOMAIN DOMAIN.org.: Found existing domain cache entry06/27 13:26:09 [MAILSLOT] Received ping from COMPUTER.DOMAIN.org (null) on <Local>

注意netlogon 服务保留两个密码、 当前和以前的密码。 更改所需的时间当,netlogon 生成一个新的密码、 将当前的密码存储在以前的密码存储区中并将新密码写入当前密码存储区。 此后,它会尝试将推送到 DC 的当前密码。

如果在计算机处于脱机状态,在时间 (或待检等待提出和执行 PEAP 802.1x),它将后,并稍后执行它。但是,新密码 netlogon 被视为当前的密码。这是在当前的密码失败的情况下,它将尝试以前密码的 Netlogon,没问题。 现在与 netlogon 的 802.1x 通信存在的问题是该 802.1x 可以当前只访问当前并不知道 DC 上还在此方案中的密码。

警告:本文已自动翻译

属性

文章 ID:904943 - 上次审阅时间:03/17/2010 06:54:27 - 修订版本: 2.0

Microsoft Windows Server 2003 Standard Edition, Microsoft Windows Server 2003 Enterprise Edition, Microsoft Windows Server 2003 Datacenter Edition, Microsoft Windows XP Professional Edition, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Datacenter Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Server, Windows Vista Enterprise, Windows Vista Ultimate, Windows Vista Home Premium, Windows Vista Home Basic, Windows Vista Business, Windows 7 Enterprise, Windows 7 Enterprise N, Windows 7 Home Basic, Windows 7 Home Premium, Windows 7 Home Premium N, Windows 7 Professional, Windows 7 Professional N, Windows 7 Release Candidate, Windows 7 Starter, Windows 7 Starter N, Windows 7 Ultimate, Windows 7 Ultimate N

  • kbmt kbtshoot kbprb KB904943 KbMtzh
反馈