Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

The RPC server is unavailable 0x800706ba Kerberos Authentication problems

$
0
0

when I attempt to establish a WMI connection from a Windows 2008 server to another Windows 2008 server in the same domain i get The RPC server is unavailable 0x800706ba error. (Firewall is not an issue because it's disabled on both computers for all 3 profiles)

KRB_AP_ERR_MODIFIED error can be seen in Network monitor trace which points to "Kerberos Authentication problems" 

http://blogs.technet.com/b/askds/archive/2008/06/11/kerberos-authentication-problems-service-principal-name-spn-issues-part-3.aspx

when i try to runQuerySPN.vbs on the target computer, I am getting no SPN found, which leads me to believe that I am not specifying a correct parameter.

Any help would be greatly appreciated 

Thanks


Edit:


Additionally when I try to connect from ANY computer on the network to the target 2008 server I get event ID 4 logged on the source

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server TARGET_SERVER$. The target name used was RPCSS/TARGET_SERVER.DOMAIN.LOCAL This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (DOMAIN.LOCAL) is different from the client domain (DOMAIN.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

Edit:


from the elevated command prompt i ran

setspn -S RPCSS/TARGET_SERVER.DOMAIN.LOCAL TARGET_SERVER followed by                                      setspn -S RPCSS/TARGET_SERVER TARGET_SERVER

I no longer get event id 4 logged, but now i am getting event id 10028

DCOM was unable to communicate with the computer TARGET_SERVER using any of the configured protocols; requested by PID      70c (C:\Windows\System32\wbem\wbemtest.exe).




Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>