SharePoint 2010 authentication intermittent

Question

I have a SP site which is setup to authenticate with an external two-way trust domain. I've used the stsadm tool to configure the people-picker to browse this domain and add users/groups to this site. For the most part authentication works fine but have a select few (not disabled) which just can't login. The check permissions tool says that have the desired relevant access but the login prompt just keeps re-appearing.

Here's where it gets stranger. Sometimes my own trusted domain account takes three attempts to login before this is accepted whereas others are allowed in straight away!

Are there any logs for troubleshooting login at all? I'm struggling to find these.

What could be the problem? I'd be happier if this just didn't work across the board to make troubleshooting a bit easier but then this job would be easy wouldn't it ;)

Any advice much appreciated.

Answer 1

Well turns out all users accessing this site need to be added to the hosting server's 'Local Policies > User Rights Assignment > Access this computer from the network' policy. It was an accidental discovery by adding a test user to a few groups in order to test this issue further.

I addressed another issue prior to this where the following error is displayed when a foreign SID attempts to RDP to servers in this domain where NLA is in use.

"The Local Security Authority cannot be contacted".

The solution for this was to add users to this same policy or add them to the local administrators group on the server. This would explain why some users authenticated whereas others didn't - Not all of the SharePoint users were RDP allowed users...

It didn't help not having an error display or appearing in any logs. All I got was a the credential prompt window over and over again. Especially frustrating in a domain which locks out accounts after three failed attempts.

Hope this helps someone else.