Network Management
Windows AD group logins fail with "Windows account unauthorized" and NULL SID warnings in the SolarWinds Platform
In SolarWinds Platform environments where individual AD accounts can log in but users assigned via AD/Windows groups cannot, the login may fail with "Windows account unauthorized" while OrionWeb.log shows NULL SID warnings and NetworkCleartext logon attempts, and correcting the Windows authentication configuration (database and IIS providers) restores group login.
First published date
Last published date
Overview
The issue occurs when logging in to the SolarWinds Platform Web Console using Windows Authentication and AD security groups: direct AD user accounts work, but users who should inherit access through AD groups receive "Windows account unauthorized" even though the groups are granted permissions in the SolarWinds Platform. OrionWeb.log records warnings that group membership checks return NULL SIDs and that logon attempts use NetworkCleartext/Default and fail. This behavior has been observed on recent NPM-based releases such as NPM 2024.4 and 2025.2.
Related articles providing background and SQL examples include:
• Error Logging in to the SolarWinds Platform Web Console Using Windows AD Account
Product section
Cause
Windows Authentication attempts to use a NetworkCleartext logon path that is not accepted by the AD/domain security configuration, causing WindowsIdentity retrieval to fail and group SIDs to be returned as NULL. This behavior may be enforced by a LogonUserType = NetworkCleartext entry in the WebSettings table, which forces NetworkCleartext instead of the standard Negotiate/NTLM flow.
The SolarWinds site in IIS may have Windows Authentication providers ordered incorrectly, so that the effective negotiation path leads to failed Kerberos/NTLM resolution for group membership and repeated NULL SID warnings for the affected AD groups.
Resolution
Windows authentication supports two authentication protocols, Kerberos and NTLM, which are defined in the <providers> element of the website configuration.
When we install and enable Windows authentication on IIS 10 for example, by default, two providers are available: Negotiate and NTLM.
Negotiate is a container that uses Kerberos as the first authentication method, and if the authentication fails, NTLM is used. It is also required that Negotiate comes first in the list of providers.
A few more details:
• Negotiate - This provider will attempt to use Kerberos for authentication if it is available.
• NTLM - This provider will attempt to use Windows NT LAN Manager for authentication.
Please consider the following steps:
1 - RDP in the server that hosts your Main Polling Engine.
2 - Open the Microsoft IIS (Internet Information Service).
3 - Check the priority in Provider settings (Authentication → Select Windows authentication → Providers).
4 - Ensure that the first provider in the list is Negotiate.
5 - After saving, log in to the SolarWinds Platform to see if the issue was resolved.