How to monitor communication between the BCAAA service, the Netlogon service and the Domain Controller.
The BCAAA service is used to authenticate proxy users within a Windows domain but it does not itself communicate with a Domain Controller. Instead, BCAAA communicates with its local Windows Netlogon service to perform user authentication. Although the BCAAA service provides a method to write its own debug information (see 000010313) it can be useful to know what the Netlogon service itself is sending to a Domain Controller. Microsoft's NLTEST.EXE program allows debugging to be enabled on the Netlogon service. How to do this is described in the Microsoft article KB109626 (with KB189541 providing information on possible error codes).
Netlogon debugging should be enabled on the BCAAA server. By looking at the results of the Netlogon.log file, you can monitor authentication events. (Note that this log file can become large very quickly so it is advisable to enable logging only during testing).
The following are example entries found in the Netlogon.log file during failed and successful login attempts.
06/06 12:41:02 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\johndoe from W2K3-DC1 Entered 06/06 12:41:02 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\johndoe from W2K3-DC1 Returns 0xC000006A <-- Indicates bad password ...
06/06 12:42:38 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\baduser from W2K3-DC1 Entered 06/06 12:42:38 [LOGON] VDOMAIN: NlPickDomainWithAccount: baduser: Algorithm entered. UPN:0 Sam:1 Exp:0 Cross: 0 Root:1 DC:0 06/06 12:42:38 [LOGON] VDOMAIN: SamLogon: Network logon of (null)\baduser from W2K3-DC1 Returns 0xC0000064 <-- Indicates unknown user name ...
06/06 12:45:07 [LOGON] VDOMAIN: SamLogon: Network logon of vdomain\johndoe from W2K3-DC1 Entered 06/06 12:45:07 [LOGON] VDOMAIN: SamLogon: Network logon of vdomain\johndoe from W2K3-DC1 Returns 0x0 <-- Indicates successful logon
Imported Document ID: 000014487
Subscribing will provide email updates when this Article is updated. Login is required.
Thanks for your feedback. Let us know if you have additional comments below. (requires login)
Subscribed to the Article.
Unable to subscribe
Thanks for your additional feedback !!!
Enterprise Support Virtual Agent
Rate Me :
Tell us more:
Welcome! My name is Sami, the Enterprise Support Virtual Agent answering technical support questions.