Troubleshooting Windows/Domain Authentication

Troubleshooting Windows/Domain Authentication

Umango utilizes standard Windows Interactive Logon protocols to verify user credentials. If you encounter "Access Denied" or "Logon Failure" errors, it is often due to restrictive security policies on the host server or within your Active Directory environment.

Note: These settings are managed via Domain Group Policy (GPO) or the Local Security Policy editor (secpol.msc) on the Umango server.

1. User Account Rights

For authentication to succeed, the Windows security subsystem requires the user account logging on to have the right to log on locally to the server.

Policy Setting Required Configuration
Allow log on locally The user account (or their group) must be listed here.
Deny log on locally The user must NOT be listed here, as Deny overrides Allow.

2. Application Service Permissions

The Umango service logon account must have the authority to request security tokens from Windows.

  • Ensure the Umango service is running as LocalSystem or a member of the local Administrators group.
  • In hardened environments, the service account may specifically require the SE_TCB_NAME (Act as part of the operating system) privilege.

3. Active Directory Health

If you are using Domain accounts, ensure the following:

  • The server has clear network connectivity to the Domain Controller.
  • The server's system clock is synchronized with the Domain Controller.
  • The user account is not locked out or restricted by "Logon Hours" in Active Directory.

How to Verify Settings

  1. Press Win + R, type secpol.msc, and press Enter.
  2. Navigate to Local Policies > User Rights Assignment.
  3. Double-click Allow log on locally to ensure your users are permitted.
  4. Restart the Umango service to apply any policy changes.