topic Re: Kerberos pre-authentication issues - why now? in Network Access Control

Kerberos pre-authentication issues - why now?

rstevek — Sun, 10 Mar 2019 23:50:00 GMT

Hi all,

We recently put up a new Windows 2003 Active Directory domain controller to replace a de-commissioned Windows 2000 DC. When my VPN users try to authenticate to it using Kerberos, they are getting rejected with a pre-authentication failed error. I know that this is a common issue with the ASA, and TAC has confirmed that there's no solution for it yet. However, we have another W2K3 DC that has never had this issue. So why now? Why this new DC? What's the difference between my DCs where one can authenticate a user with pre-authentication enabled and one can't?

Any help or information that I can get would be helpful.

Thanks,

- Steve

Re: Kerberos pre-authentication issues - why now?

Jatin Katyal — Fri, 04 Dec 2009 17:43:45 GMT

Hi Steve,

Pre-authentication on the Active Directory (AD) should be disabled or it can lead to user authentication failure.

You can check the kerberos authentication example for the same.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008060f261.shtml

HTH

Plz rate helpful posts-

Re: Kerberos pre-authentication issues - why now?

rstevek — Fri, 04 Dec 2009 18:12:23 GMT

Hi JK,

Thanks for the reply.

Right, I understand that, and TAC directed me to the same document. But we have an existing domain controller that we are currently using the authenicate against; pre-authentication is enabled, and it works fine. It's only the NEW domain controller that has this problem. So I'm trying to figure out what the difference is!

I would rather NOT disable pre-authentication for all VPN users if possible - there are a lot of them and it lessens the security of Active Directory.

Thanks,

- Steve

Re: Kerberos pre-authentication issues - why now?

Scott Wertz — Mon, 13 Jan 2025 13:26:07 GMT

Sorry to revive a really ancient post, but did you ever figure this out? We're finding that Apple Mac users get their AD account locked after connecting to VPN and a Kerberos pre-auth event occurs.