Can't authenticate with servers if the user is in the built-in group "Protected Users"

Question

We can authenticate if we login to the machine hosting the service but if I have the client installed on my desktop, I can't authenticate with any of the services when my account is in the "Protected Users" group.

This is what my list of services look like:

More information on the group: https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group

Comments

Hello Mark,

For troubleshooting purposes, please, specify the following:

• Do you face any errors when trying to connect to the Adaxes service on a remote computer while logged in using credentials of the account that is a member of the Protected Users group? If you do, please, post here or send us at support@adaxes.com screenshots of the errors.
• Can you connect to the Adaxes service on a remote computer when logged in using credentials of the account that is not a member of the Protected Users group?

Any additional details would be much appreciated.

---

• If I log into the server that is hosting the adaxes service, I can login to the service just fine.
• If I try to remotely connect to the service using the client, it fails.

The error we get when trying to connect to the service is below.

Answer 1

Hello Mark,

Thank you for specifying. The issue occurs because by default NTLM is used for connection between the Administration console and the Adaxes service while NTLM is prohibited for members of the Protected Users group and Kerberos must be used. To remedy the issue, you can try to do the following:

1. On the computer where Adaxes Administration Console is installed, navigate to folder C:\Users\All Users\Softerra\Adaxes 3.
2. Open the Softerra.Adaxes.Adsi.dll.config file with a text editor.
3. Locate the application/channels/channel XML element.
4. Set the servicePrincipalName parameter to the username of the Adaxes service account (specified during Adaxes installation) in the username@company.com format. For example:

<application>
    <channels>
        <channel ref="tcp" priority="2" secure="true" servicePrincipalName="username@company.com">
            ...
        </channel>
    </channels>
</application>

5. Save the file.
6. Close the Adaxes Administration console.
7. Sign out the currently logged on user and then sign back in.
8. Launch the Adaxes Administration console.

IMPORTANT: the approach will work only for the Adaxes services that are installed using the credentials of the account whose username is specified in the servicePrincipalName parameter.

Comments

Worked! Thank you!