Member Avatar for mreeves

Hey guys I have a quick question for you.

In my place of work we have three shipping computers, SHIP-1, SHIP-2 and SHIP-3.

Normally they all work pretty good. We can access our two servers (FS1 and FS2) and log into Worldship and MAS90. Well as of late we have been having problems with SHIP-2. The above error is what we receive when I try to go to say, the "G:" drive of our network. The G drive is a folder on FS1.

The folder's on FS2 are accessible, however I can't seem to get into FS1 under only the computer SHIP-2. There has been nothing new changed on that computer as of late to make this error appear. Also the username that is utilized works on other computers but not SHIP-2, yet as far as I know it is the only user name that will not work. I tried my account which is an admin account and it works fine to access FS1.

If anyone has any idea what's going on, that would be great.

Thank you!
--Mike

  • 6 Contributors
  • 6 Replies
  • 375 Views
  • 4 Years Discussion Span
  • Latest Post Latest Post by ShadowMasterTx

Dani AI

Generated

Short practical checklist and extra context (adds to and answers).

A few common root causes when one workstation can reach FS2 but gets “Logon failure: unknown user name or bad password” only to a single file server: the client is sending wrong/cached credentials or the server is matching the name to a different account (local vs domain), the workstation’s computer account/secure channel with the domain is broken, or Kerberos/clock skew is preventing proper authentication. The security log entries (Event ID 4625 on modern systems; older systems log 529) give the exact failure reason and the Status/SubStatus codes you need to interpret. (learn.microsoft.com)

Quick, non-destructive checks you can run as a local admin (do these before nuking profiles):

  • Show and drop active network sessions:
    net use
net use * /delete
  • Inspect and remove saved Windows credentials (Credential Manager / cmdkey):
    cmdkey /list
cmdkey /delete:TARGETNAME
control /name Microsoft.CredentialManager
rundll32.exe keymgr.dll,KRShowKeyMgr

    If a mapped drive or cached credential is being sent with the wrong domain/username, explicitly map using the server account to test:

    net use G: \\FS1\Share /user:DOMAIN\username *

    SMB/netlogon follows a clear algorithm for which account it tests first; specifying domain\user or clearing stored creds often fixes transient “1326” / unknown-user errors. (learn.microsoft.com)

If credentials/clearing mappings do not help, check and repair the computer-domain secure channel (requires domain connectivity and appropriate rights):

Test-ComputerSecureChannel -Verbose
Test-ComputerSecureChannel -Repair -Credential DOMAIN\Admin
nltest /sc_verify:DOMAIN
netdom resetpwd /s:DC /ud:DOMAIN\Admin /pd:*

These commands let you repair a broken machine account without immediately rejoining the domain. (learn.microsoft.com)

Kerberos/time: confirm the workstation and DC clocks are tightly synced and purge stale tickets before re-testing:

klist
klist purge
w32tm /resync

Kerberos rejects tickets with large clock skew (default tolerance is small), which will look like password failures even when passwords are correct. If rebuilding the local profile (as the OP found) fixed it, that indicates a local credential/profile corruption — but the steps above let you diagnose and fix the real cause so it does not keep recurring. (learn.microsoft.com)

Recommended Answers

All 6 Replies

Member Avatar for DaveB

Hi Mike

All I can think of, is to check event viewer on Ship-2, and either research the Event ID's through MS, or post them here.

To open event viewer go Start > Run > "eventvwr.msc".

Try to access the G:\ Drive, and note the time. Check for events within the security or system log at that time, specifically any Red Error Messages. The events will have Event ID's.

If you want to search yourself, head to MS Technet

http://technet.microsoft.com/en-gb/default.aspx

or post them here for us to help. (Please add the PCs and Server Operating System versions).

Regards, David.

Member Avatar for Dark_Archon

Since your are the Administrator or have the Administrator rights, just delete that user account and create new one. Also check for virus or hardware failure on the pc.

Good luck

Member Avatar for mreeves

Sorry for not responding quickly but that is what I ended up doing. They are on our domain and since nothing gets saved in their folders I simply removed them from the User Accts page on the computer and then got rid of their folder so that the next time they logged in it would be like the first time and since other accts of their 'security' level was working on that computer I assumed this to be the right path and it was.

Thanks for those who helped or even thought about it!
--Mike

Since your are the Administrator or have the Administrator rights, just delete that user account and create new one. Also check for virus or hardware failure on the pc.

Good luck

Member Avatar for domg25

A mystery user has just appeared on my computer and has created a password both for itself and for me, this creates a problem that I can no longer log onto my own computer, I have since disconnected the computer from the motem thinking that i have just been hacked. Has anybody out there got any idea on what i can do? your help would be appreciated.

Member Avatar for Bob_180_Bob

Hi,
You have piggybacked a thread from Jun 16th, 2007. I have no idea what is wrong with your machine but i would guess that you have a virus. Go to Viruses, spyware and other nasties on this site and read about cleaning your PC.
http://www.daniweb.com/forums/thread27570.html
If you still have problems, start a new thread there with a lot more information about your PC. read about, Hijack this, download it and run it and post the log here with your post.

Edited by Bob_180_Bob because: n/a
Member Avatar for ShadowMasterTx

I realize this thread is old. I am commenting only for those who might find it via a search engine..

Disconnecting from the modem as you see above does not solve the root of the problem. If someone has hacked their way in via a modem, then you have the same problems with not being patched or having known passwords, or a weak (or no) firewall.

Don't forget, when you open a pipe, via modem or via Ethernet, it's a two way connection. Always have the needed firewalls in place (EVERY TIME), or your just asking to be hacked.

A research study was done a few years ago (by CNET I think but could be wrong). They connected an unprotected machine via dial up to the internet, and it was discovered and attempts to hack it were made in under 6 minutes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.