Server 2019 login issue

[robintech]

Another wild guess is the interface has gone off domain authenticated after the reboot and the free disk space is unrelated to the current problem, but not sure how that would relate to the errors

 

Get-NetConnectionProfile

#Name : Network 3

#InterfaceAlias : directnic

#InterfaceIndex : 9

#NetworkCategory : Public

#IPv4Connectivity : LocalNetwork

#IPv6Connectivity : NoTraffic

 

restart-service NlaSvc -Force

 

#Name : Contoso

#InterfaceAlias : directnic

#InterfaceIndex : 9

#NetworkCategory : DomainAuthenticated

#IPv4Connectivity : Internet

#IPv6Connectivity : NoTraffic

Edited November 29, 2023 by ittech2342323

[simpsonj]

Another wild guess is the interface has gone off domain authenticated after the reboot and the free disk space is unrelated to the current problem, but not sure how that would relate to the errors

 

Get-NetConnectionProfile

#Name : Network 3

#InterfaceAlias : directnic

#InterfaceIndex : 9

#NetworkCategory : Public

#IPv4Connectivity : LocalNetwork

#IPv6Connectivity : NoTraffic

 

restart-service NlaSvc -Force

 

#Name : Contoso

#InterfaceAlias : directnic

#InterfaceIndex : 9

#NetworkCategory : DomainAuthenticated

#IPv4Connectivity : Internet

#IPv6Connectivity : NoTraffic

 

Looks like it's DomainAuthenticated, but thanks for the idea.

 

It's the fact I can't even login from the Hyper-V host using the Virtual Machine Connection that bugs me the most. Something has gummed up the Local Session Manager, and I can't see how to clear it.

[robintech]

yeah think it's time to put it out of its misery

[simpsonj]

yeah think it's time to put it out of its misery

 

Yep, I've reached out to a company to see if they can migrate SIMS for me.

 

In the mean time, and because I'm really bad at letting things go, I've scanned with LanSweeper and it's picked out some Events that might help, such as:

 

Event 1005

DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:

{A47979D2-C419-11D9-A5B4-001185AD2B89}

 

Probably a wild goose chase, but I'm happier if I'm doing something whilst waiting for someone else...

[simpsonj]

dism /online /cleanup-image /scanhealth

The component store is repairable

 

First time Windows has even acknowledged there might be a problem, looks promising

 

dism /online /cleanup-image /restorehealth

72.7%

Error: 5

 

Access is denied

 

[kevin_lane]

Have you got any sort of sccm system place

 

Which could be deploying some weird setting ??

 

Also don’t know if is been said but remove it to a different ou?

 

Can you login locally I.e not on the domain

 

I know it’s drastic but you if you can drop it from

The domain should clear any group policies that could be effecting it if anything

Edited November 29, 2023 by kevin_lane

[simpsonj]

Have you got any sort of sccm system place

 

Which could be deploying some weird setting ??

 

Also don’t know if is been said but remove it to a different ou?

 

Can you login locally I.e not on the domain

 

I know it’s drastic but you if you can drop it from

The domain should clear any group policies that could be effecting it if anything

 

No SCCM in place here.

 

My servers only have the absolute minimum of GPOs deployed to them (Default Policy, Network safe zone, Certificate auto-enrollment, Smoothwall certificate, Smoothwall login script), so I don't think it's a GPO thing.

 

Can't login locally, can't get to the username/password field at all.

 

Dropping it from the domain is my nuclear option; at the moment I can at least access the server via Powershell and command line. The moment I take it off domain, if it doesn't allow me access, I'm left with an absolute potato!

 

Thanks though, I'll try blocking inheritance on this server's OU, see if it is a GPO thing.

[simpsonj]

It does look like my admin account is 'lodged' in the system, and it's constantly trying, and failing, to login with that account, and therefore it's blocking all other accounts from logging in.

 

Why a simple reboot doesn't clear this though, I don't know. Maybe something stuck in the Registry somewhere?

[Olliedawg]

It does look like my admin account is 'lodged' in the system, and it's constantly trying, and failing, to login with that account, and therefore it's blocking all other accounts from logging in.

 

Why a simple reboot doesn't clear this though, I don't know. Maybe something stuck in the Registry somewhere?

 

Have been silently following - glad you are getting somewhere. You could try remove the stuck user via powershell & then attempt a log in once this is done (possibly with another account?). Although like you say, its strange that a reboot didn't clear this

[simpsonj]

You could try remove the stuck user via powershell & then attempt a log in once this is done (possibly with another account?)

 

Do you mean using DelProf (or the Powershell equivalent)?

[Olliedawg]

Do you mean using DelProf (or the Powershell equivalent)?

 

I think Delprof would be the easiest.. Delprof cleans up registry as well so you can be sure the profiles are completely removed

[kevin_lane]

Sorry if I sound dense

 

When you say can’t get to the login screen, do you mean getting past the crtl-alt-del or before that ?

 

Just trying to figure out when you say it keeps trying to log you in / try and use your authentication

 

https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/windows-logon-scenarios

[simpsonj]

Sorry if I sound dense

 

When you say can’t get to the login screen, do you mean getting past the crtl-alt-del or before that ?

 

Just trying to figure out when you say it keeps trying to log you in / try and use your authentication

 

https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/windows-logon-scenarios

 

Essentially can't get past ctrl+alt+delete, the login box doesn't show. I've disabled ctrl+alt+delete requirement via GPO and now it shows my admin login trying to login for about 0.5 seconds, then flips back to the time and date screen.

[simpsonj]

There are events in Event Viewer that mention NTLM (and that I shouldn't be using it) so I'm presuming it's going down that particular route.

 

Whatever is stuck trying to log this account in presumable isn't a service, as they all get restarted. So a file, or registry entry would make more sense.

 

No idea how to repair/replace/rebuild those .dll files though, if they are causing the problem.

[kevin_lane]

Have you tried booting into safe mode with cod prompt you could try the sfc repair again via that method maybe ??

[simpsonj]

I'll give it a go!

[simpsonj]

Nope, still trying to load up the Local Session Manager (which will fail) and no command prompt available.

[kevin_lane]

Ok…what about getting the 2019 server iso mounting it and booting from that into a cmd prompt and trying the repair ?

[simpsonj]

Ok…what about getting the 2019 server iso mounting it and booting from that into a cmd prompt and trying the repair ?

 

Try loading from the DVD and running sfc /scannow - didn't detect any issues

Kept the DVD mounted and booted as normal then ran the dism repair, using the mounted DVD as the source - claimed the source files could not be found

 

I've got a company to do the transfer, so unless they ant to try resurrecting this server, I think it's done.

 

Thanks to everyone for their suggestions, don't think this puzzle will ever be solved.