Avatar of gmwindows
gmwindows
 asked on

Permissions Issue

Hello Experts,

I'm having a weird issue on a few of my servers.
I have a NAS that i connect to for backing stuff up. For some reason, i have lost the ability to access the NAS via it's name.
So, if i go to start run: \\backupNAS\   --> i get an error saying i don't have permissions to access this.
If i do: start run: \\10.10.10.50\    --> i get in with no problems.

Can anyone shine some light on this please?

Thank you,

gmWindows
Windows Server 2003DNSActive Directory

Avatar of undefined
Last Comment
gmwindows

8/22/2022 - Mon
LHT_ST

if you ping backupnas does it give you the same ip address as you gave above?
gmwindows

ASKER
Yes it does.
When I ping it via IP, it responds.
When I ping it via Name, it responds.
Tasmant

it's probably due to Kerberos errors. (with IP you fall automatically to NTLM)
- is the name of your computer (backupNAS) is the same than the name you enter in start/run ?
- could you launch the command setspn /L backupNAS
  you should see HOST/backupNAS and HOST/backupNAS.domain.com
if you don't see them, you should run: setspn /R backupNAS
- it could be an issue with multiples computers sharing the same SPN
take a look here http://support.microsoft.com/kb/321044/en-us
or launch the command:
dsquery * -limit 0 -filter "(&(objectcategory=computer)(ServicePrincipalName=HOST/backupNAS))"
if duplicate, you will get more than one DN as result.
Your help has saved me hundreds of hours of internet surfing.
fblack61
gmwindows

ASKER
All the tests you mentioned above came back ok.
The entries were there and there were not duplicates.
When i queried it from LDAP it came back with the correct machine.
I checked the System logs and found the following two entries:

Type: Warning
Source: LsaSrv
The Security System detected an authentication error for the server cifs/backupNAS.local.domainname.com.  The failure code from authentication protocol Kerberos was "The specified user does not exist.

Type: Warning
Source: Kerberos

There were password errors using the Credential Manager. To remedy, launch the Stored User Names and Passwords control panel applet, and reenter the password for the credential DOMAIN\admin.

Tasmant

ok launch this command to add the cifs service and retry
setspn /A cifs/backupNAS
setspn /A cifs/backupNAS.local.domainname.com
gmwindows

ASKER
It's already in there.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
ASKER CERTIFIED SOLUTION
Tasmant

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
gmwindows

ASKER
That worked.
Windows caching is a blessing and a curse (more leaning towards the latter).
Thank you!
Tasmant

on the backupNAS server, have you looked event viewer to see if there is errors or warnings especially with Kerberos and LSASRV?
are the time on your computer, the DCs and the BackupNas server are well synched (or at least with few than 5 minutes of delta) ?
Tasmant

Ok happy this worked :)
As soon as you encounter issues with name but not with IP you can be pretty sure it's related to Kerberos authentication failures :)
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
gmwindows

ASKER
What reading material would you suggest for one who would like to learn more of how Kerberos works?
Tasmant

I think you can begin with this: http://technet.microsoft.com/fr-fr/library/cc772815%28WS.10%29.aspx
be carefull with headache !
gmwindows

ASKER
Awesome! Thank you!
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.