![\"\"](\"https:\/\/itblog.wildi.dk\/wp-content\/uploads\/2024\/07\/image-11.png\")
<\/figure>\n\n\n\nDie Fehlersuche startet ich im lokalen Eventlog, und wurde f\u00fcndig:<\/p>\n\n\n\n «Logon Type 2» bedeutet gem\u00e4ss Microsoft<\/a> «Interactive (also known as, Logon locally)». Schnell hatte ich den Verdacht, dass die GPO’s der Microsoft Security Baselines<\/a> dies verhindern. Und so war es auch:<\/p>\n\n\n\n «Lokal anmelden zulassen» ist nur f\u00fcr «VORDEFINIERT\\Administratoren» zugelassen<\/p>\n<\/blockquote>\n\n\n\n Wir haben den Service-Account f\u00fcr die Einrichtung durch den Hybrid-Wizard tempor\u00e4r zu den lokalen Administratoren hinzugef\u00fcgt. So m\u00fcssen wir die MSFT-GPO’s nicht anpassen, und die Security ist weiterhin gew\u00e4hrleistet, ohne zus\u00e4tzliche Rechte.<\/p>\n","protected":false},"excerpt":{"rendered":"![\"\"](\"https:\/\/itblog.wildi.dk\/wp-content\/uploads\/2024\/07\/image-12-816x1024.png\")
<\/figure>\n\n\n\nAn account failed to log on.\n\nSubject:\n\tSecurity ID:\t\tDOMAIN\\adminuser\n\tAccount Name:\t\tadminuser\n\tAccount Domain:\t\tDOMAIN\n\tLogon ID:\t\t0x4FEC3\n\nLogon Type:\t\t\t2\n\nAccount For Which Logon Failed:\n\tSecurity ID:\t\tNULL SID\n\tAccount Name:\t\tsvc_ServiceAccount\n\tAccount Domain:\t\tDOMAIN\n\nFailure Information:\n\tFailure Reason:\t\tThe user has not been granted the requested logon type at this machine.\n\tStatus:\t\t\t0xC000015B\n\tSub Status:\t\t0x0\n\nProcess Information:\n\tCaller Process ID:\t0x2ef8\n\tCaller Process Name:\tC:\\Users\\adminuser\\AppData\\Local\\Apps\\2.0\\94JYCV39.N4Q\\0EWQ5O80.Q5K\\micr..tion_5661bd3e342e4e9f_0011.0001_9a1ee13031f92f9c\\Microsoft.Online.CSE.Hybrid.App.exe\n\nNetwork Information:\n\tWorkstation Name:\tSERVERNAME\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\n\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\n\nThe Process Information fields indicate which account and process on the system requested the logon.\n\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/itblog.wildi.dk\/wp-content\/uploads\/2024\/07\/image-14-1024x905.png\")
<\/figure>\n\n\n\n\n