Network Management

Active Directory user: Login failure. User name and/or password incorrect in Orion

OrionWeb.log shows "Logon failure: the user has not been granted the requested logon type at this computer". When attempting to log into the Orion Web Console, an Active Directory (AD) user enters the correct username and password but gets the message < Login failure. User name and/or password incorrect.>.

First published date

10/24/2018 6:56 PM

Last published date

12/21/2022 2:56 PM

Overview

When attempting to log into the Orion Web Console, an Active Directory (AD) user enters the correct username and password but gets the following message:
 

Login failure. User name and/or password incorrect. 


An entry similar to the following is in the OrionWeb.log, located at %ProgramData%\Solarwinds\Logs\Orion\OrionWeb.log on your Orion server:

WARN  SolarWinds.Orion.Web.OrionMixedModeAuth - (null)  System.Security.Authentication.AuthenticationException: Cannot logon 
'username@domain' via Interactive/Default ---> System.Runtime.InteropServices.COMException: Logon failure: the user has not been granted 
the requested logon type at this computer. (Exception from HRESULT: 0x80070569)

Product section

Orion Platform

Cause

A permissions issue causes this.

With the default setting, users are not able to log in using AD until they have rights to physical (interactive) log-in to the device where IIS is hosted. 
If the web.config value EnableFallback is changed to "True", it lowers necessary rights for login to NetworkClearText (used in most scenarios).
EnableFallback = True means users are able to log in without local log-in rights.

Resolution

Resolution 1: 

Resolution 2: 

  • Enable Lightweight Directory Access Protocol (LDAP).

    1. Log in to the Web Console using a local Orion account (non-domain account).
    2. Click Settings > All Settings > User Accounts > Advanced AD Settings.
    3. Switch Authenticate Active Directory Users via LDAP to ON.
    4. Fill in the appropriate LDAP server information and Save it.
    5. If all the above sitting was working, delete the user account and recreate it.

Resolution 3:

  • Enable LogonFallback on the web. config file in C:\inetpub\Solarwinds:

Resolution 4: 

  • Check the connection between the AD server and the Orion server. 

Resolution 5:

  • Check if the account is enabled using the database manager.
    • 1. RDP to the Orion server and open database manager.
    • 2. Query the Accounts table and look for the account name.
    • 3. Check the column for 'AccountEnabled.' It should be set to 'Y.'
Resolution 6:

For Hybrid AD environments in case using a firewall with a rule to disable Internet access, the user may encounter an issue to login.

Interactive logon type requires internet access and does not work without access to login.microsoftonline.com
On the other side, NetworkCleartext logon type works without any issues even without access to login.microsoftonline.com.
The recommendation is to switch LogonUserType to NetworkCleartext. Then authentication should work.

How to switch LogonUserType to NetworkCleartext?
Go to the database manager and execute SQL statement: 
Disclaimer: Scripts are not supported under any SolarWinds support program or service. Scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.

IF NOT EXISTS (SELECT * FROM [dbo].[WebSettings] WHERE [SettingName] = 'LogonUserType')
BEGIN
INSERT INTO [dbo].[WebSettings] ([SettingName] ,[SettingValue]) VALUES ('LogonUserType', 'NetworkCleartext')
END
ELSE
BEGIN
UPDATE [dbo].[WebSettings] SET [SettingValue] = 'NetworkCleartext' WHERE [SettingName] = 'LogonUserType'
END