RRAS drive mapping not working anymore

[rrafluap]

Hi,

 

We are using RRAS for our dial-in VPN service (L2TP- with PSK) and all of a sudden, users are unable to access file shares using their domain credentials. What used to happen is they'd connect to the VPN, a VBS script would run to map drives and printers. As the VPN had logged them in using their domain credentials, there was no need to specify any credentials for home drives etc in the scripts. Now however, they are logged in... (I can ping the DC), the script says the password was incorrect. If I try and access the share manually via windows explorer, I receive: 0x80004005 unspecified error. But manually mapping the drive with credentials will work... The only thing that I can find is in the domain controller security event log (the RRAS server's entries look fine) screenshots are attached. Perhaps I'm not searching online for the correct keywords but I can't seem to find anything that will help. As you can see, the dial-in computer's user credentials are being used to attempt authentication (not domain) with the domain controller having just been authenticated by the RRAS server using them???

 

Any help is appreciated by me and lots of frustrated teachers

 

Thanks, Paul

[Cache]

It's not some weird consequence of the recent windows updates is it? https://www.bleepingcomputer.com/news/microsoft/new-windows-kb5009543-kb5009566-updates-break-l2tp-vpn-connections/

[rrafluap]

I did think that but again, unless I'm not searching the correct thing, I can't find anyone else with the same issue. We didn't experience that specific issue but that's not to say that it isn't?

[Cache]

I'd be tempted to remove the update from a device and test to see if it reverts back to the correct behaviour, atleast it would rule it out? Maybe on another install kb5010793 and see if that fixes it?

[rrafluap]

I'll try it in the morning and report back, thanks!

[rrafluap]

Uninstalling the update didn't fix the issue (I'm running 21H2 so its KB5003791).

[Cache]

Not sure, if you try to connect to the share via IP does it prompt for credentials? Does it make any difference if you alter the rasphone.pbk file to set UseRASCredentials=0 so that instead of trying to use the RAS credentials it will use the windows credentials? I know they are both the same but wonder if you can point it to something with RAS not passing it on correctly.

[rrafluap]

Connecting with the IP instead doesn't change anything and also UseRasCredentials was set to 1 but didn't make a difference when trying to connect with it either way.

[Cache]

setting to 1 uses the RAS credentials, if you set it to 0 it should use the credentials logged on to the device. Even though they are both the same set of credentials, just wondering if RAS is messing with something.

[rrafluap]

So I tried a few things over the weekend, connecting with it on both 0 and 1, no luck. Also, set up a temp 2022 server and tried that, exactly the same issue. I'm going to trawl through the GP settings to see if a recent policy definition update was to blame?!

[rrafluap]

There's nothing that suggests its the GP settings. Have also come across someone else with a similar issue but never came up with a permanent fix unfortunately. (https://techcommunity.microsoft.com/t5/windows-servicing/january-2022-quality-update-breaks-passing-domain-credentials/m-p/3129892#M1458) Seems its down to the details not being stored in the credential manager correctly?! I'm not sure the workaround will work for us as our users are forced to change their passwords fairly regularly and will be really reluctant to be messing with the Credential Manager.