DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 954415 - Last Review: July 23, 2008 - Revision: 1.0

SYMPTOMS

Consider the following scenario:
  • You try to log on to a domain controller from a Windows Server 2008-based computer or from a Windows Vista-based computer.
  • The domain controller runs an operating system that is earlier than Windows Server 2008.
In this scenario, the logon is unsuccessful. Additionally, you receive the following error message:
Logon failure: Unknown username or bad password

CAUSE

This issue occurs if the following account options are turned on in the properties of the user account:
  • Use DES encryption types for this account
  • Do not require Kerberos preauthentication

WORKAROUND

To work around this issue, turn off the account options. To do this, follow these steps:
  1. On the domain controller, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. Expand your domain, and then click Users.
  3. In the details pane, right-click the user account name that you used to log on to the domain controller, and then click Properties.
  4. Click the Account tab, and then click to clear the following check boxes in the Account options list:
    • Use Kerberos DES encryption types for this account
    • Do not require Kerberos preauthentication
  5. Click Apply, and then click OK.
  6. Exit the Active Directory Users and Computers snap-in.
  7. Verify that you can successfully log on to the domain controller.

APPLIES TO
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Datacenter
  • Windows Server 2008 Standard
  • Windows Web Server 2008
  • Windows Server 2008 for Itanium-Based Systems
Keywords: 
kbprb kbexpertiseinter kbtshoot KB954415
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support