How To Fix Unauthenticated Network

Home
Networking
General Networking

Has anyone been able to overcome this issue? We have been dealing with this issue for several months now and are not seeing any resolution from Microsoft in sight.

These are some of the things we have tried so far: (keep in mind these are not fixes, only temporary solutions)

1. ipconfig /release /renew (only temporary reoccurs after reboot)

2. Changing the power settings of the network card to a delayed start

3. Delete and re-scan the network card from the hardware manager

4. Dis-join pc from domain, rejoin (also delete theassociated AD object, then force replication)

5. Disable IPv6

6. cmd > netsh winsock reset, netsh int ipv4 reset reset.log, netsh int ipv6 reset reset.log

7. Disable IPv6 to 4 tunneling in group policy (this essentially tells the adapter to skip looking for an IPv6 address, even though v6 is disabled)

If there is any more information that I can provide please let me know.

33 Replies

Alex3031

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Nov 14, 2014 at 16:50 UTC

Have you tried removing the networks from the registry?

What triggered the event? Upgrade? MS Patch? Restore from Restore Point?
More trigger info or history, please...

One of the main problems we're now experiencing is we joined 2 brand new laptops to the domain and one of them immediately went unauthenticated after it's first reboot while the other has not had it once. The only difference between the 2 is the name of the machine.

No we have not made any registry changes to the affected machines.

The only event that we can trace this back to was when we blocked access to the control panel for the domain users. As we have 20 workstations and 12 laptops, this only is affecting random machines after boot up.

We have since reverted this change.

Alex3031

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Nov 14, 2014 at 17:03 UTC

From this link http://blogs.technet.com/b/networking/archive/2010/09/08/network-location-awareness-nla-and-how-it-r...

the following snippet tells you the registry keys you should look at/delete. I had issues with this and tried all you could think of, eventually had to remove all traces of networks from these keys and let it all auto detect anew. Also make sure that DNS is good on the affected machine(s) and that the firewall is allowing all the proper ports.

                              Most info regarding NLA will be stored under the following three places:  HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList HKLM\Software\Microsoft\Windows\CurrentVersion\HomeGroup C:\Windows\System32\NetworkList Historical data can be found under the Cache key:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache  Profiles are stored under the profiles key. Notice the GUID:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{985EE69C-23B4-4D38-AC66-5F0D6AD8A128}  "ProfileName"="corp.microsoft.com" "Description"="corp.microsoft.com" "Managed"=dword:00000001 "Category"=dword:00000002 "DateCreated"=hex:d9,07,0b,00,01,00,10,00,11,00,30,00,1c,00,68,02 "NameType"=dword:00000006 "DateLastConnected"=hex:da,07,07,00,04,00,0f,00,03,00,12,00,1d,00,b9,03 And managed Networks are stored under the Signatures\Managed key:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed\010103000F0000F0A00000000F0000F077ABED71E35E1237A502490669F3BF81C3215FEB0A05CB1B6D53F11EB0B0D47C  "ProfileGuid"="{985EE69C-23B4-4D38-AC66-5F0D6AD8A128}" "Description"="corp.microsoft.com" "Source"=dword:000000a0 "DnsSuffix"="northamerica.corp.microsoft.com" "FirstNetwork"="corp.microsoft.com" "DefaultGatewayMac"=hex:00,07,b3,00,00,00 While unmanaged networks are stored under Signatures\Unmanged:  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged

Thank you, I'll take a look at this here soon.

Is this on all machines regardless of installation, configuration etc? (Mainly, does the problem surface if it's a brand-new install)

If not, what are the common factors separating the impacted from non-impacted computers?

Figure out if your winsock reset has broken anything else... like security software or firewalls

http://technet.microsoft.com/en-us/library/cc753591%28v=ws.10%29.aspx#BKMK_3

Did you migrate from server 2003 DCs to server 2012 or 2012 R2? See

http://blogs.technet.com/b/askds/archive/2014/07/23/it-turns-out-that-weird-things-can-happen-when-y...

This is on all desktop/laptops randomly. It does happen on brand new installs, in fact it happens much more often on brand new installs. All computers are using the same group policy.

It is very random as some could have the issue 5 times a day others may not have it but a couple times a week/month.

We did upgrade to 2012 R2 but the upgrade was from 2008 R2.

With the issue being intermittent, it sounds like there my be an issue with one DC as opposed to across your infrastructure... You could try shutting down all but one DC (outside of production hours of course) and try logging in with a known problem station. Do this with all DCs in turn to see which one(s) have problems.

This is all assuming that your dcdiags and other AD health troubleshooting doesn't reveal anything.

Also assuming that you've already gone through the various event logs on the client and server machines when this occurs without finding anything relevant or otherwise helpful.

We're a 24/7 facility so shutting down one of our DC's is not a valid option, the logs are as clean as could be and don't show anything out of the ordinary.

Alexanderdiogenes wrote:

We're a 24/7 facility so shutting down one of our DC's is not a valid option, the logs are as clean as could be and don't show anything out of the ordinary.

Ummm..... Sorry, it's Monday and all, but I'm confused..... You indicate that you're a 24/7 site, but based on this comment I have to infer that you only have 1 Domain Controller?

No sorry there are 2 DC's in our environment.

Alexanderdiogenes wrote:

No sorry there are 2 DC's in our environment.

Good to hear, so if everything's working properly in AD, you *should* be able to shut one down for a short period without any significant impact.... Sure some FSMO roles will be unavailable for a short period, but IIRC so long as you aren't making any infrastructure changes everything should still work from an access and authentication perspective.

Hoping someone with a bit more expertise than I can offer will chime in....

Okay we have tried shutting down DC2 then shut down DC1. This didn't clear up our unauthenticated issue as we still got it after trying this with both servers being turned off consecutively.

Are there any more recommendations?

I'm not sure what is supposed to be deleted in these registry entry locations. Do I delete all of the entries that refer to the domain?

Long over due update to this issue. We have been working with Microsoft on this issue and from their recommendations and trial and error on our own.

We are still getting a long lapse in time for Windows 7 to identify the network (2-3 minutes)

Steps we have taken:

Created outbound firewall rules.

1 for UDP, port 389 and allowing all profiles

2 for TCP, port 389 and allowing all profiles

The issue here is why do we need to add firewall rules for Windows to communicate with itself, i.e. client to server relations???

This is not a fix for this issue, only a work around.

We have come across a solution that is working and not just a band aide.

Restoring the firewall settings to their defaults has given us the best results so far.

When reproducing the issue there is a immediate re-connection to our domain and haven't seen (unauthenticated) since this has been put into place even after multiple reboots and physical cable disconnects.

We are encountering this issue presently on a few machines.

Can you more fully describe your solution? Resetting the firewall to the default policy does not seem to have any effect on the issue. Disabling and re-enabling the adapter is successful, however it is temporary.

Any direction you can provide would be appreciated. Thanks.

Control Panel\All Control Panel Items\Windows Firewall

Lower left Restore defaults

1. This is in my last update on this issue and is now our working solution. There seems to have been an issue when we upgraded our domain from a 2008R2 to 2012R2 and there were some machines that were having this issue constantly.

2. Also setting up outgoing ports in the windows firewall w/ advanced security.

Create two exceptions 1 for UPD & 1 for TCP both for port 389 and allowing all traffic access domain/home/public.

Hope this helps.

i have solved it by rejoining the domain

bakrihamed wrote:

i have solved it by rejoining the domain

We are constantly having this issue as well. Seems to have started about 3 weeks ago. Only thing that was done was routine monthly Windows patches and updates. From that point, we are constantly having various PC's becoming "unauthenticated".

Completely disjoining and rejoining the domain fixed this issue for you? I will give that a shot on the next PC this happens to.

We had this problem occur after a DC crash. Turns out after the crash the DC had the wrong date/time settings. Resetting it back to the correct date and time solved the problem on the PCs.

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.