Alternate domain credentials 3.5

[Nordberg]

I am in need of assistance concerning active scanning on multiple domains using different credentials.

So this is my setup:

I currently have 2 domains I want to scan using active scanning.

localdomain.dom (netbiosname: LOCALDOMAIN)
custdomain.dk (netbiosname: CUSTDOMAIN.DOM)

The LanSweeper server is located in localdomain.dom with the name lscentral.localdomain.dom.
LanSweeper service is running with a local user called "lscentral\svc_lansweeper".

I have defined the two domains for "domain scanning" in active scanning:
localdoamain.dom
custdomain.dk

In domain credentials I have defined the two seperate domain users that I want the lansweeper service to use when scanning:
LOCALDOMAIN - LOCALDOMAIN\LSScan - ********
CUSTDOMAIN.DOM - CUSTDOMAIN.DOM\LSScan - *******

I have created the users in both domains with "domain admins" membership.

Lansweeper does not scan the domains and I get the following error in the log:
11-03-2009 14:10:30: localdomain.dom Logon failure: unknown user name or bad password.
11-03-2009 14:10:30: custdomain.dk Logon failure: unknown user name or bad password.

----

If I change the user under which the service runs to LOCALDOMAIN\LSScan, the error for localdomain.dom disappears and lansweeper is able to scan the computers in localdomain.dom.
custdomain.dk is still getting the "Logon failure" error.

It looks to me like the mapping between the domains to scan, and the credentials to use is not working.

Any help would be greatly appreciated.

[Nordberg]

I am still experiencing this problem.

I have done numerous tests to verify that the setup is as it should be.

Latly I have been using ADExplorer ( http://technet.microsoft.com/en-us/sysinternals/bb963907.aspx ).
When running ADExplorer on the Lansweeper machine, I can easily access both domains using the same credentials that I use in GUI Console.

I still get the error listed in my previous posts, which leaves me to believe that the alternative domain credentials functionality in Lansweeper 3.5 does not work when the domains are not trusted with eachother.

Can you confirm this - or in any other way shed some light on what might be the problem in my case.

[Hemoco]

Nordberg wrote:
Can you confirm this - or in any other way shed some light on what might be the problem in my case.

There is indeed a problem with not trusted domains.
We are looking if there's an easy way to fix it.

The alternate credentials were originally designed to solve the problem that you had when using one forest and had to choose one account which had access to everything.

[Nordberg]

I will be happy to provide any additional information you might need.

Screenshots, configuration files, table dumps etc.

If you need it I can also make a quick drawing of our setup, if it is needed for understanding.

[Hemoco]

Nordberg wrote:
I will be happy to provide any additional information you might need.

Screenshots, configuration files, table dumps etc.

If you need it I can also make a quick drawing of our setup, if it is needed for understanding.

I understand why it's not working, I'll come back to this later.

[Nordberg]

The service runs as LOCALDOMAIN\LSScan now.

LOCALDOMAIN\LSScan has administrative rights in the LOCALDOMAIN domain.

LOCALDOMAIN\LSScan has NO RIGHTS and does not exist in CUSTDOMAIN.DOM

CUSTDOMAIN.DOM has a user account called CUSTDOMAIN\LSScan that has administrative rights in the CUSTDOMAIN.DOM domain, but it uses a different password for security reasons.

There is no trust between the domains, so there is no single user that has access to read both domains.

[Hemoco]

This is the cause of your problem:

The account running the service (lscentral\svc_lansweepe) must have read access to all domain controllers in one of the other domains to check for computer logons. (for active scanning)

The credentials are used for the actual scanning process not for the "reading" of the domain controllers.

Are my assumptions correct that this is the case?

[Nordberg]

I am not using the beta.

Now the service is running with a user that has "domain admins" membership in "localdomain.dom".

I put in the netbiosname of the secondary domain I want to scan (CUSTDOMAIN.DOM) along with a user CUSTDOMAIN.DOM\LSScan and correct password.

I still get the error:
11-03-2009 14:56:59: custdomain.dk Logon failure: unknown user name or bad password.

at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
at System.DirectoryServices.ActiveDirectory.Domain.GetDomain(DirectoryContext context)
at LansweeperService.mdlActivescanning.ActiveScan()

[Hemoco]

Did you use the beta version of version 3.5? (there was a bug in the alternate credentials)

In active scanning : use the netbios domain name instead of the full name

The account running the service (lscentral\svc_lansweepe) must have read access to all domain controllers in one of the other domains to check for computer logons.