Tuesday, June 4, 2013

VPN issue with a user account - error 800 - on Windows Essentials 2012 and SBS 2011

A client called and reported a VPN connection problem with an error 800. Interestingly, the issue happened only on his account and not the others. 

I proceed with testing on the administrator account, found out that it works!
I went on to Google to search for the possible issues that might be related, I searched from this aspect:
  1. User remote access privileges
  2. User network access protocol blockage
  3. Whether there is a 'Deny' access on any of the security groups
  4. Is it related to the IP address or the network that the client is connecting from
Further on, I started to search through the web for solutions, some links in my searches: 

1) Reconfiguring the Remote Access Services - VPN - http://www.windowsecurity.com/articles-tutorials/Windows_Server_2012_Security/understanding-configuring-network-policy-access-services-server-2012-part2.html 
While it doesn't make sense to do this, I was out of solutions and I think this was a good try. I tried and to my dismay, the problem persists, and only onto this particular user account.
2) Technet article on the correct way in establishing the Essentials Server 2012 VPN services - http://technet.microsoft.com/en-us/library/jj635063.aspx

3) A VPN server issue and it's security protocols - http://social.technet.microsoft.com/Forums/en-US/winserveressentials/thread/f17ec934-821c-4fe7-bb44-679bdf0e4ad3

This link provides a check on client configuration as well as network set-up. Having the VPN connected clients to be in the same DHCP region as LAN, I don't see any issues with the network part of the connection. Moreover, I am facing problem with ESTABLISHING the VPN and not accessing the network servers.


4) Possibly a few cases of someone facing a similar problem with no resolutions
  • This is one close one: http://undepurated10.motutaro.com/browser.php?indx=6583078&item=612
  • This is one SUPER CLOSE: http://social.technet.microsoft.com/Forums/en-US/winserveressentials/thread/617af2e7-a904-44f3-a9f0-173658bfa848
  • This is one EXACT SAME ISSUE: http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/thread/63e1855d-69eb-43f5-b3d3-52494cdb542d

5) Issues related to 3rd party applications affecting the VPN as a whole - http://forums.hak5.org/index.php?/topic/25381-server-2008-r2-vpn-error-812/

This is related to issues with VPN from Antivirus software or firewalls. I don't have this issue as the server does allow VPN connection in general, just NOT on 1 account.

There are some good troubleshooting references in the link that we all ought to follow for the troubleshooting process. Some posts here talks about NPS and the pains in getting that set-up or configured properly.  

6) Troubleshooting guide related to NPS - http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/62c382fc-ebf8-4c69-9569-5cda792a19bf/

Decent article in step-by-step troubleshooting if NPS is the issue. I went through this and found out that it's not an NPS or Network Access Policy services that's stopping the VPN.



========================================================================

After trying for close to 3hrs, I gave up, and created a new user account specifically to allow only for VPN. I used a similar naming convention.. So if the user was Andy Tan and his log-in account is andytan, then the new account was andyt and i set the same password for the user, with similar account privileges simply for VPN access. 

This solved the issue and client is happy. Anyway, it's not worth the amount of time to troubleshoot, but it's interesting that such a 'bug' occurs. I do am looking forward to Microsoft solving this issue though.

I will post in some of the community forum to see if they can figure a resolution.

1 comment:

Unknown said...

Hi all,

We have some relief / good news in that we have recently struggled with this but found an answer.

The clue was that the issue was linked to the username (not user SID) as others have mentioned.

Reviewing the NPS event logs, we found event ID: 6273:



Remote Access Account Lockout is enabled, and the user's authentication attempts have exceeded the designated lockout count because the credentials they supplied (user name and password) are not valid. The user account will be removed from the locked out list on successful authentication or on the expiration of the configured lockout time. To manually reset a locked out account, delete the registry subkey that corresponds to the user account name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AccountLockout\domain name:user name



We located the registry key and remove the user we had the issue with. Connection then worked and tested fine.



Hope this helps,



James and the team.