The system detected a possible attempt to compromise security.

[colinrharris]

The server is running Server 2008 with a Group Policy for re-directed folders.

One user (using the same logon) is using two computers, one with Win 7 32 bit and the other with Win 7 64 bit.

Most of the time, both computers start up and log on to the domain without any problems. However, every so often one PC will start up OK and the other will come up with the error message: The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.

There will be no desktop icons and no wallpaper and a second logon prompt. If that logon prompt is completed (the same as the first logon prompt), the icons then appear but the desktop stays black (no wallpaper), the icons are the default size and are all on the left, rather than arranged as the last logon.

At first it was the 64bit machine that was the problem but now it is the other one.

I appreciate that this is probably connected with re-directed folders, which includes the desktop folder. However, it is not consistent so I wonder why this only happens sometimes and to either of the PC's.

I have tried starting one up and waiting until the boot up has completed before starting the other, but this does not help. I have also tried refreshing the desktop but this doesn’t help either. Usually 3 or 4 re-boots are required before normality is restored.

Why does this happen and why is it seemingly random?
How can I stop this happening?
Thanks

 

[cyberspace]

Are you logging on to the same DC each time? How many do you have in the domain (or site?) It sounds like you are being warned of a potential man in the middle attack but indeed it may be caused by something else.

When you get the dodgy display have you tried opening up a command prompt and using the command "echo %LOGONSERVER" to see which DC authenticated the user?

'When all else fails.......read the manual'

 

[colinrharris]

Yes, it is the same DC each time - there is only one. I suppose it's still worth running the command "echo %LOGONSERVER", just to check if I am logged on at all. Any other suggestions? The problem is intermittent, so I cant say when it will next happen, so I will do all the tests suggested on the next occurrence.

thanks

 

[cyberspace]

Are you using roaming profiles? I know that some of my users have problems moving between 32 and 64 bit machines...

'When all else fails.......read the manual'

 

[colinrharris]

Not using roaming profiles but I am using re-directed folders.