Solutions

Using the Windows Netlogon service debug option to diagnose BCAAA problems

Solutions ID:    KB4431
Version:    1.0
Status:    Published
Published date:    06/06/2011
 

Problem Description

How to monitor communication between the BCAAA service, the Netlogon service and the Domain Controller.

Resolution

The BCAAA service is used to authenticate proxy users within a Windows domain but it does not itself communicate with a Domain Controller. Instead, BCAAA communicates with its local Windows Netlogon service to perform user authentication. Although the BCAAA service provides a method to write its own debug information (see KB2934) it can be useful to know what the Netlogon service itself is sending to a Domain Controller. Microsoft's NLTEST.EXE program allows debugging to be enabled on the Netlogon service. How to do this is described in the Microsoft article KB109626 (with KB189541 providing information on possible error codes).

Netlogon debugging should be enabled on the BCAAA server. By looking at the results of the Netlogon.log file, you can monitor authentication events. (Note that this log file can become large very quickly so it is advisable to enable logging only during testing).

Authentication errors

The following are example entries found in the Netlogon.log file during failed and successful login attempts.

06/06 12:41:02 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\johndoe from W2K3-DC1 Entered
06/06 12:41:02 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\johndoe from W2K3-DC1 Returns 0xC000006A            <-- Indicates bad password
...

06/06 12:42:38 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\baduser from W2K3-DC1 Entered
06/06 12:42:38 [LOGON] VDOMAIN: NlPickDomainWithAccount: baduser: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0
06/06 12:42:38 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\baduser from W2K3-DC1 Returns 0xC0000064            <-- Indicates unknown user name
...

06/06 12:45:07 [LOGON] VDOMAIN: SamLogon: Network logon of vdomain\johndoe from W2K3-DC1 Entered
06/06 12:45:07 [LOGON] VDOMAIN: SamLogon: Network logon of vdomain\johndoe from W2K3-DC1 Returns 0x0                  <-- Indicates successful logon

 


Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
 
 
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.
 
 

Your response will be used to improve our document content.

Ask a Question