Pass Through Authentication chooses wrong user account on ..

Weird one. If you're inclined to help, you may want to draw a picture.

2 Servers:

Mars (Windows 2003) has two local accounts, AccountA and AccountB, both
local administrators.
Pluto (Windows 2000) has two local accounts, also named AccountA and
AccountB, both local administrators.

Both servers are member servers (not DCs) on the same mixed mode 2003
domain.

The passwords for AccountA and AccountB are the same on both servers
(respectively), for the purpose of pass-through authentication.

I log in to Mars locally with AccountB, and UNC to \\Pluto\c$ at the run
command, expecting the local AccountB on Pluto to be used to access the
shared resource. I get the message that it is not accessible, and that the
referenced account is currently locked out and may not be logged on to.
When I check the security log on Pluto, I see that instead of it using the
local AccountB account to access the share (as I would expect pass-through
authentication to do), it is instead using AccountA (even though I was
logged in with AccountB on Mars). This happens not just with the default
shares, but any share AccountB has access to.

Any idea why Pluto would attempt to use the opposite account when logically
it should grab the one with the same name as what I'm logged into Mars with?

If I do everything the same, except log in with AccountA, everything works
fine.

Any thoughts appreciated!!

Phil

Logs from Pluto:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 09/05/2006
Time: 11:34:04 AM
User: NT AUTHORITY\SYSTEM
Computer: Pluto
Description:
The logon to account: AccountA
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: Mars
failed. The error code was: 3221226036

and:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 09/05/2006
Time: 11:34:04 AM
User: NT AUTHORITY\SYSTEM
Computer: Pluto
Description:
Logon Failure:
Reason: Account locked out
User Name: AccountA
Domain: Pluto
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: Mars

On Mars go to Control Panel - stored user names and passwords to see if
anything is shown there which may be using the other user account. You can
remove entries from there if you want. --- Steve


"Phil McNeill" <philmcneill.DeleteThis@NOSPAM4MEhydroottawa.com> wrote in message
news:uQXIGO4cGHA.3556@TK2MSFTNGP02.phx.gbl...
> Weird one. If you're inclined to help, you may want to draw a picture.
>
> 2 Servers:
>
> Mars (Windows 2003) has two local accounts, AccountA and AccountB, both
> local administrators.
> Pluto (Windows 2000) has two local accounts, also named AccountA and
> AccountB, both local administrators.
>
> Both servers are member servers (not DCs) on the same mixed mode 2003
> domain.
>
> The passwords for AccountA and AccountB are the same on both servers
> (respectively), for the purpose of pass-through authentication.
>
> I log in to Mars locally with AccountB, and UNC to \\Pluto\c$ at the run
> command, expecting the local AccountB on Pluto to be used to access the
> shared resource. I get the message that it is not accessible, and that
> the referenced account is currently locked out and may not be logged on
> to. When I check the security log on Pluto, I see that instead of it using
> the local AccountB account to access the share (as I would expect
> pass-through authentication to do), it is instead using AccountA (even
> though I was logged in with AccountB on Mars). This happens not just with
> the default shares, but any share AccountB has access to.
>
> Any idea why Pluto would attempt to use the opposite account when
> logically it should grab the one with the same name as what I'm logged
> into Mars with?
>
> If I do everything the same, except log in with AccountA, everything works
> fine.
>
> Any thoughts appreciated!!
>
> Phil
>
> Logs from Pluto:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Account Logon
> Event ID: 681
> Date: 09/05/2006
> Time: 11:34:04 AM
> User: NT AUTHORITY\SYSTEM
> Computer: Pluto
> Description:
> The logon to account: AccountA
> by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> from workstation: Mars
> failed. The error code was: 3221226036
>
> and:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 539
> Date: 09/05/2006
> Time: 11:34:04 AM
> User: NT AUTHORITY\SYSTEM
> Computer: Pluto
> Description:
> Logon Failure:
> Reason: Account locked out
> User Name: AccountA
> Domain: Pluto
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: Mars
>
>
>