Quantcast
Channel: Remote Desktop Services (Terminal Services) forum
Viewing all articles
Browse latest Browse all 21489

EventID 4625 (NULL SID) when trying to establish RDP connection over port forwarding firewall

$
0
0

Hi,

i created an environment with an IPCop Firewall. My goal is to establish a RDP connection to Terminal Server (IP 192.168.70.12) on the good (GREEN) side of the firewall from a client on the bad (RED) side of the firewall. To make this possible i create a port forwarding rule in the firewall, which forwards from port 7012 to port 3389.

Now i try to build up a connection from my client to the Terminal Server with mstsc and the address 10.0.14.118:7012 (10.0.14.118 is the RED IP Address of the firewall). When i try this, i get the following message:

"Login failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced".

In the EventLog of the Terminal Server i get the following Event:

An account failed to log on.

Subject:
 Security ID:  NULL SID
 Account Name:  -
 Account Domain:  -
 Logon ID:  0x0

Logon Type:   3

Account For Which Logon Failed:
 Security ID:  NULL SID
 Account Name:  dkoenig_adm
 Account Domain:  imagoverum

Failure Information:
 Failure Reason:  Unknown user name or bad password.
 Status:   0xC000006E
 Sub Status:  0xC000006E

Process Information:
 Caller Process ID: 0x0
 Caller Process Name: -

Network Information:
 Workstation Name: DKOENIG-LAPTOP
 Source Network Address: -
 Source Port:  -

Detailed Authentication Information:
 Logon Process:  NtLmSsp
 Authentication Package: NTLM
 Transited Services: -
 Package Name (NTLM only): -
 Key Length:  0

What goes wrong here, what can i do to solve this issue? The RDP session works perfectly, when i open the connection from a client within the GREEN network and the same credentials.

Thanks in advance

Regards
Dave



Viewing all articles
Browse latest Browse all 21489

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>