Users Cannot Connect to a Windows Server 2003 Domain by Using a VPN Connection

SYMPTOMS

Users cannot connect to a Windows Server 2003 domain by using a virtual private networking (VPN) connection. This problem occurs if the following conditions are true:

•	The users try to connect to the domain through a Cisco router.
•	The Cisco router uses Kerberos authentication to authenticate the users against a Windows Server 2003-based domain controller.

Back to the top

CAUSE

This problem occurs because the Key Distribution Center Service returns the wrong user name format to the router.

Back to the top

RESOLUTION

Hotfix Information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451 (http://go.microsoft.com/?linkid=6294451)

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Prerequisites

No prerequisites are required.

Restart Requirement

You must restart your computer after you apply this hotfix.

Hotfix Replacement Information

This hotfix does not replace any other hotfixes.

File Information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version      Size     File name   Platform
  -------------------------------------------------------------------
  30-Sep-2003  20:21  5.2.3790.89  225,792  Kdcsvc.dll  x86
  30-Sep-2003  20:20  5.2.3790.89  584,704  Kdcsvc.dll  IA-64

Back to the top

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article.

Back to the top

MORE INFORMATION

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Back to the top

---

APPLIES TO

•	Microsoft Windows Server 2003, Standard Edition (32-bit x86)
•	Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)

Back to the top

Keywords:

kbhotfixserver kbqfe kbbug kbfix kbqfe kbwinserv2003presp1fix KB829074

To Install the Remote Access Service Server

If the remote access service server is a member of a domain, it must be a member of the RAS and IAS Servers group in that domain.

If you are not a member of the Domain Admins group, a member of that group must add this server to the RAS and IAS Servers group.

If you are a member of the Domain Admins group, the server is automatically added to the RAS and IAS Servers group after you complete the procedures that are included in this document.

To Enable the Routing and Remote Access Service and Configure a VPN Interface

1.	Click Start, point to Administrative Tools, and then click Routing and Remote Access.
2.	Click the server that matches the local server name in the left pane of the console. If the icon has a red circle in the lower-left corner, the Routing and Remote Access service is not enabled. Go to step 3. If the icon has a green arrow pointing up in the lower-left corner, the service is enabled. If so, you may want to reconfigure the server. To reconfigure the server, you must first disable Routing and Remote Access. To do this, right-click the server, and then click Disable Routing and Remote Access. Click Yes when you are prompted with an informational message.
3.	Right-click the server, and then click Configure and Enable Routing and Remote Access to start the Routing and Remote Access Server Setup Wizard. Click Next.
4.	Click Remote access (dial-up or VPN) to enable remote computers to dial in or connect to this network through the Internet. Click Next.
5.	Click VPN for virtual private access, or click Dial-up for dial-up access, depending on the role you want to assign to this server.
6.	On the VPN Connection page, click the network interface that is connected to the Internet, and then click Next.
7.	On the IP Address Assignment page, do one of the following: • If a DHCP server will be used to assign addresses to remote clients, click Automatically, and then click Next. Go to step 8. • To give remote clients addresses only from a pre-defined pool, click From a specified range of addresses. In most cases, the DHCP option is simpler to administer. However, if DHCP is not available, you must specify a range of static addresses. Click Next. The wizard opens the Address Range Assignment page. a. Click New. b. In the Start IP address box, type the first IP address in the range of addresses that you want to use. c. In the End IP address box, type the last IP address in the range. Windows calculates the number of addresses automatically. d. Click OK to return to the Address Range Assignment page. e. Click Next.
8.	Accept the default setting No, use Routing and Remote Access to authenticate connection requests, and then click Next.
9.	Click Finish to enable the Routing and Remote Access service and to configure the server to run Routing and Remote Access.

You can now configure the server as a VPN server.

Setting Up a Client for Remote Access

After you set up the server to receive dial-up connections, you must set up a remote access client connection on the user's workstation.

To Set Up a Client for a Dial-Up Connection

To set up a client for dial-up access, follow these steps on the client workstation.

NOTE: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1.	Click Start, click Control Panel, and then double-click Network Connections.
2.	Under Network Tasks, click Create a new connection, and then click Next.
3.	Click Connect to the network at my workplace to create the dial-up connection, and then click Next.
4.	Click Dial-up connection, and then click Next.
5.	On the Connection Name page, type a descriptive name for this connection, and then click Next.
6.	On the Phone Number to Dial page, type the phone number for the remote access server in the Phone Number dialog box.
7.	Do one of the following, and then click Next: • If you want to allow any user who logs on to the workstation to have access to this dial-up connection, click Anyone's use. • If you want this connection to be available only to the currently logged-on user, click My use only.
8.	Click Finish to save the connection.

To Set Up a Client for a VPN Access Connection

To set up a client for VPN access, follow these steps on the client workstation:

NOTE: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1.	Click Start, click Control Panel, and then double-click Network Connections.
2.	Under Network Tasks, click Create a new connection, and then click Next.
3.	Click Connect to the network at my workplace to create the dial-up connection, and then click Next.
4.	Click Virtual Private Network connection, and then click Next.
5.	On the Connection Name page, type a descriptive name for this connection, and then click Next.
6.	Do one of the following, and then click Next: • If the computer is permanently connected to the Internet, click Do not dial the initial connection. • If the computer connects to the Internet by way of an Internet service provider (ISP), click Automatically dial this initial connection, and then click the name of the connection to the ISP.
7.	Type the IP address or the host name of the VPN server computer (for example, VPNServer.SampleDomain.com).
8.	Do one of the following, and then click Next: • If you want to allow any user who logs on to the workstation to have access to this dial-up connection, click Anyone's use. • If you want this connection to be available only to the currently logged-on user, click My use only.
9.	Click Finish to save the connection.

To Connect to the VPN Server

After you create a VPN connection on your local workstation, you can connect to the server. To do this, follow these steps.

NOTE: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1.	Click Start, point to Connect To, and then click the new connection that you created.
2.	In the User Name box, type your user name. If the network to which you want to connect has multiple domains, you may have to specify a domain name. If this is the case, use the domain_name\user name format in the User Name box.
3.	In the Password box, type your password.
4.	If you use a dial-up connection, check the phone number that is listed in the Dial box to make sure that it is correct. Make sure that you have specified any additional numbers that you must have to obtain an external line or to dial long-distance.
5.	Click Dial or Connect (for VPN connections). Your computer establishes a connection to the remote access server. The server authenticates the user and registers your computer on the network.

Configuring the Server to Accept Remote Clients and Granting Remote Access Rights to Users

In Windows Server 2003, authorization is granted based on the dial-in properties that you set in the user account in Active Directory and on the remote access policy that you set for the remote access server. With remote access policies, you can grant or deny authorization based on criteria, such as the time of day, day of the week, the user's membership in Windows Server 2003 security groups, or the type of connection that is requested.

When you install the Routing and Remote Access service and you configure the server that will run it, Windows creates a default policy that grants access to all users, provided that dial-in permissions have been enabled (these permissions are configured on a user-by-user basis). For users to be able to dial-in and authenticate to a remote access server, these settings must be enabled in their user accounts.

When the server is a member of a domain, you can set these settings by using the users' domain accounts.

When the server is a standalone server or member of a workgroup, the users must have local accounts on the remote access server.

To Allow the Server to Accept Remote Access Clients

1.	Click Start, point to Administrative Tools, and then click Routing and Remote Access.
2.	Double-click the server object, and then click Remote Access Policies.
3.	Right-click Connections to Microsoft Routing and Remote Access server, and then click Properties.
4.	Click Grant remote access permission, and then click OK.
5.	Close Routing and Remote Access.

To Grant Dial-up Access Permission to Individual Users

1.	Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2.	Right-click the user account for which you want to enable remote access, and then click Properties.
3.	Click the Dial-in tab, click Allow access, and then click OK.
4.	Close the UserAccount Properties dialog box.

To Grant Remote Access Permission to a User Group

1.	Create a group with members who are permitted to create VPN connections.
2.	Click Start, point to Administrative Tools, and then click Routing and Remote Access.
3.	In the console tree, expand Routing and Remote Access, expand the server name, and then click Remote Access Policies.
4.	Right-click the right pane, point to New, and then click Remote Access Policy.
5.	Click Next, type the policy name, and then click Next.
6.	Click VPN for virtual private access, or click Dial-up for dial-up access, and then click Next.
7.	Click Add, type the name of the group that you created in step 1, and then click Next.
8.	Follow the on-screen instructions to complete the wizard.

If the VPN server already permits dial-up networking remote access services, do not delete the default policy; instead, move it so that it is the last policy to be evaluated.

Troubleshooting

If You Receive an Error Message That the Specified Destination Is Not Reachable

Verify that the client is connected to the network. To test whether the remote server can be contacted, follow these steps:

1.	Click Start, point to Programs, point to Accessories, and then click Command Prompt.
2.	At the command prompt, type the following, and then press ENTER: pingservername

If the ping request times out, try pinging the IP address of the remote server to see if there is a Domain Name System (DNS) name resolution issue.

If You Can Contact the Server, but You Cannot Successfully Authenticate

Verify that the user account that you are using has been granted permission to dial in and authenticate with Active Directory. The server that you are contacting must be a member of the RAS and IAS Servers group.

---

APPLIES TO

•	Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
•	Microsoft Windows Server 2003, Standard Edition (32-bit x86)
•	Microsoft Windows Small Business Server 2003 Premium Edition
•	Microsoft Windows Small Business Server 2003 Standard Edition

Keywords:

kbnetwork kbnetwork kbsecurity kbhowtomaster KB324747

This file is set up to automatically select the "1ST TRY THIS" choice after 30 seconds. Try it first, if it was the wrong selection, you will likely get one of these four errors:

1. Windows could not start because file "\system32\hal.dll was missing or corrupt

2. Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk. Check boot path and disk hardware. Please check the Windows documentation about hardware disk configuration and your hardware reference manuals for additional information.

3. I/O Error accessing boot sector file multi(0)disk(0)fdisk(0)\BOOTSECT.DOS

4. Immediate reboot

If you get the immediate reboot or some other weird error, try pressing F8 at the "1st Try This" selection screen, it will give you a prompt where you can select Safe Mode, and then try the "1st Try This" option again. Safe Mode is a special "minimal" version of Windows that doesn't load certain parts of the operating system that might have caused the problem.

One of the choices should eventually boot you back into Windows. (What if none of the options worked?) .

Use windows to fix the boot files on the hard drive.

If you got back into Windows, stop whatever you are doing and backup your most important information from this computer.

Now that you are done backing up the most important info, try to change back whatever you were last doing and boot normally, it that doesn't work, put the floppy back into the broken computer and double click the fixntldr.bat file on the floppy drive, if it asks you to overwrite a file, just type in y for yes (the file copies boot.ini, ntldr, ntdetect.com from the floppy to the C:\ drive and removes the read only attributes). That process take a few minutes, then remove the floppy and reboot.

If you are using the cd or usb solution, copy the boot.ini, ntldr, and ntdetect.com files to My Computer > Local Disk C:\ > and overwite whatever files might be there, then right click each file, choose properties, uncheck the Read Only attribute, and click OK.

If you get back into Windows again, you can change that "1st Try This" menu by going into Start > Control Panel > System > Advanced tab > Startup and Recovery section, Settings button > System Startup; then change the "Default Operating System:" to the selection that worked for you, and change the box that says "Time to display list of operating systems" to however many seconds you want (usually 1 second). Click OK twice. (What if the bootdisk worked, but I can't get into Windows without it?) .

NTLDR missing, press any key to restart

How to fix: NTLDR is missing, press any key to restart

What happened?

When your computer starts, the BIOS attempts to find the primary hard drive's active partition to read the first sector for the MBR (Master Boot Record), it uses that info to load the rest of the OS. For Windows NT4/2k/XP the NTLDR (New Technology Loader) takes it from there. If you get the "NTLDR is missing, press any key to restart" what's most likely going on is the BIOS either didn't look for the right drive, didn't find the right partition, it wasn't active, didn't find the MBR, or the MBR didn't list NTLDR in the right place, the location of NTLDR changed, or you are looking at a hardware failure situation (memory/cables/drive/motherboard/etc). Windows Vista does not boot this way, you can still use my floppy to boot into an existing installation of 98/nt/xp, but I've not had a chance to test Windows Vista.

If possible, try to change back whatever hardware or software change you just made (this could be as simple as leaving a floppy disk in the drive or you need to recheck the cables). (What if I made new changes that I want to keep?).

Make a NTLDR boot disk to get back into Windows.

The quick test to make sure your OS installation is still good is to create an MBR and NTLDR on a floppy disk and check your partitions, this disk will check many of the partitions for a working windows installation. Here are the instructions to do this:

1. Get a blank floppy (whatever is on it will be erased), and put it into a working computer (What if the computer doesn't have a floppy drive?).

2. Download fixntldr.exe onto a working computer (fixntldr-winnt if you are using Windows 2000 or Windows NT4) (What if I don't want to download a file from a website I don't trust?). (What if my backup system is Mac / Linux or another alt OS?).

3. Run the fixntldr.exe file by double clicking it. Click OK to overwrite the blank floppy disc in the working computer, you should see some screens about writing a new floppy disk.

4. Do you remember if the folder you had your Windows installation in was named "Windows"? If you can't remember just keep going (What if it was not named Windows but WINNT like in NT4 or 2000?) .

5. Put the new floppy (or cd/usb drive) you have just created into the computer that gets the NTLDR is missing error message, turn the broken computer off.

Using the boot disk in the computer with the "NTLDR is missing" error.

remove login password

Direct Bootup Without Typing Password

1. At a command prompt, type "control userpasswords2" and press Enter to open the Windows 2000-style User Accounts
application.
2. On the Users tab, clear the Users Must Enter A User Name And Password To Use This Computer check box and then
click OK.
3. In the Automatically Log On dialog box that appears, type the user name and password for the account you want to be
logged on each time you start your computer.

Remove Login Password

Control Panel/Administrative Tools/Local Security Settings/Minimum Password Length/Reduce it to 0 (No password required). Control Panel/User Account/Your Account/Remove Password.

Cannot Change the Administrator Password in Control Panel

After you log on as an administrator to a computer that is not a member of a domain, when you double-click User Accounts in Control Panel to change the password for the built-in Administrator account, the Administrator account may not appear in the list of user accounts. Consequently, you cannot change its password.

This behavior can occur because the Administrator account logon option appears only in Safe mode if more than one account is created on the system. The Administrator account is available in Normal mode only if there are no other accounts on the system. To work around this behavior:

- If you are running Windows XP Home Edition, restart the computer and then use a power user account to log on to the
computer in Safe mode.

- If you are running Windows XP Professional, reset the password in the Local Users and Groups snap-in in Microsoft
Management Console (MMC):

1. Click Start, and then click Run.
2. In the Open box, type "mmc" (without the quotation marks), and then click OK to start MMC.
3. Start the Local Users and Groups snap-in.
4. Under Console Root, expand "Local Users and Groups", and then click Users.
5. In the right pane, right-click Administrator, and then click Set Password.
6. Click Proceed in the message box that appears.
7. Type and confirm the new password in the appropriate boxes, and then click OK.

How to Restore a Windows XP system to a previous State using System Restore

How to Restore a Windows XP system to a previous State using System Restore

If Windows XP will start:

• Log on to Windows as an Administrator.
• Click Start, point to All Programs - Accessories - System Tools - System Restore.
• On the Welcome to System Restore page, click Restore my computer to an earlier time, and click Next.
• Or type or paste the following command in the Start - Run box then press Enter.

%systemroot%\system32\restore\rstrui.exe

This command can be used at the Safe Mode Command Prompt also.