This is an interesting little problem that I came across a few weeks ago. The scenario was this; I had a windows vista laptop which wasnt connected to a domain trying to authenticate with a windows server machine that WAS connected to a domain. Now with Windows XP I know this wouldnt have been a problem. Windows Vista on the other hand didnt want to play ball! I tried every single combination of password:

  • - Domain prefix followed by username: (mydomain\admin)
  • - Computer prefix following by username: (server1\admin)
  • - Normal username and password with no prefix for both local and domain accounts
  • - I even tried creating an identical username on the server that the laptop was logged on as, still no joy!

At this point I knew something wasnt right, I checked out the obvious firewall / anti-virus in the hope that one of them was blocking it but this wasnt the case. I tried both the hostname and ip address aswell as the FQDN but still nothing!

So I digged a bit deeper and found out that it was actually to do with NTLM (New Technology LAN Manager) authentication. In particular NTLM v2 was the root of the problem. By default Vista will only use NTLM v2 and it would appear that Windows Server 2000 and XP didnt like this. Now I have read that Windows 2000 is able to authenticate with NTLM v2 and I do recall being able to succesfully authenticate with the server before it had joined the domain, so this could well have been the catalyst.

Anyway the good news is there is  workaround, it involves a registry edit. Load up regedit (start > run > regedit)

Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Now look for the key called LmCompatibilityLevel. Double click it and change it vaues to 1.

Job done! Now give it a quick reboot and try to authenticate again and you should be ok. Sadly I have tried this same scenario with Windows 7 and had exactly the same problem! The above regedit fix should work on Windows 7 aswell, however you will probably have to create the LmCompatibilityLevel key as it wont be there by default.

Share