Server 2008 R2 & Domain Trusts - Attempt to Compromise Security

Question

We have two separate Active Directory domains; EUROPE and US. There is a two way trust between the domains / forests. I have a group of users called "USA Staff" that have access to certain shares on servers in the EUROPE domain and a group called "EUROPE Staff" which have access to shares in the USA domain.

Recently the USA PDC was upgraded to Windows Server 2008 R2. Now when I try to access a share on a USA server from a Windows 7 workstation in the EUROPE domain I get the "Please enter your username / password" dialog box appear, with a message at the bottom:

"The system has detected a possible attempt to compromise security."

When I enter a username / password for a user in the USA domain, I can then access the network resource. Entering credentials for a EUROPE user however does not give me access, even though my NTFS and Share permissions are set to allow that.

Windows Server 2003 / Windows Server 2008 did not have this problem, it seems to be unique to R2.

I found KB938457 and opened up port 88 on the Server 2008 R2 firewall but it did not make any difference.

Any other suggestions as to what to turn off in R2 to get this working again ?

Thanks

Solution

Fixed. This was a DNS problem, there were some rogue entries for the old Domain Controller that DC Promo obviously did not remove.

After removing all of those, the message went away and we could browse shares as normal.

Comments

[Admin]

i am just runnin into exactly the same problem as you did. Can you remember what DNS entries you removed? Or is there a log somewhere? Thanks for snwering Paddy

[SnAzBaZ]

Hmm! Cannot remember too much about this as it was 2 years ago! I think they were quite obvious when I looked. DNS links to the old server etc. I compared what I had for other PDC's and deleted what didnt appear to be required, making a note of the entries in case I had to add them back in again. Sorry I cannot be more specific, but take a good look through your DNS Zone for anything that looks to be related to the old server.