Question

I have a site running on IIS7. The application pool is running under a local machine account. We are using Windows Authentication to authenticate users but this is failing because the local account does not seem to have permission to make the Kerberos request to the domain controller as the event log seems to indicate:

一个账户被成功拖了。

Subject: Security ID: NULL SID

账户名称:

账户领域: -

logon ID: 0x0

类型:3

新洛贡:

Security ID:        MyDomainmark

Account Name:       Mark

Account Domain:     MyDomain

Logon ID:       0x2ed3554

Logon GUID:     {4a4f0c3f-2232-c2d9-9868-3a020042810f}

如果我使用Network Service, Local Service或 Local System,则所有工作均得罚款。因此,我需要给予我的当地机器账户更多的许可,以便它能够支持与克里伯斯的Windows Authentication?

感谢!

Answer 1

在经过一些更多的研究之后,我认为,使用与凯尔韦斯的当地机器账户,这基本上是一个有缺陷的想法。似乎没有办法在反倾销中增加当地账户,以便它能如何与域控制员沟通? 因此,我选择在地方账户下运行的场所拆散Kerberos:

cscript C:inetpubadminscriptsadsutil.vbs set w3svc/1/root/MyVirtualDirectory/NTAuthenticationProviders "NTLM"

希望有助于人们。

友情链接