A specified logon session does not exist. It may already have been terminated.
hello,
i'm trying setup wds on windows server standard 2012 r2 update after having used wds on w2k3 many years.
i can deploy images using 2012 server fine, whenever try capture image , select upload, error message "a specified logon session not exist. may have been terminated." cannot upload image simultaneously.
i tracked down error using event viewer , looks 2012 disconnecting me right after logging in because administrator login somehow considered anonymous. how enable uploads? change in group policy?
below events:
successful login:
log name: security
source: microsoft-windows-security-auditing
date: 8/30/2015 12:17:53 pm
event id: 4624
task category: logon
level: information
keywords: audit success
user: n/a
computer: libtech
description:
account logged on.
subject:
security id: null sid
account name: -
account domain: -
logon id: 0x0
logon type: 3
impersonation level: impersonation
new logon:
security id: anonymous logon
account name: anonymous logon
account domain: nt authority
logon id: 0x9688d
logon guid: {00000000-0000-0000-0000-000000000000}
process information:
process id: 0x0
process name: -
network information:
workstation name: minwinpc
source network address: 10.1.240.50
source port: 49412
detailed authentication information:
logon process: ntlmssp
authentication package: ntlm
transited services: -
package name (ntlm only): ntlm v1
key length: 128
event generated when logon session created. generated on computer accessed.
subject fields indicate account on local system requested logon. commonly service such server service, or local process such winlogon.exe or services.exe.
logon type field indicates kind of logon occurred. common types 2 (interactive) , 3 (network).
new logon fields indicate account whom new logon created, i.e. account logged on.
network fields indicate remote logon request originated. workstation name not available , may left blank in cases.
impersonation level field indicates extent process in logon session can impersonate.
authentication information fields provide detailed information specific logon request.
- logon guid unique identifier can used correlate event kdc event.
- transited services indicate intermediate services have participated in logon request.
- package name indicates sub-protocol used among ntlm protocols.
- key length indicates length of generated session key. 0 if no session key requested.
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<system>
<provider name="microsoft-windows-security-auditing" guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<eventid>4624</eventid>
<version>1</version>
<level>0</level>
<task>12544</task>
<opcode>0</opcode>
<keywords>0x8020000000000000</keywords>
<timecreated systemtime="2015-08-30t19:17:53.768686800z" />
<eventrecordid>7797</eventrecordid>
<correlation />
<execution processid="552" threadid="2040" />
<channel>security</channel>
<computer>libtech</computer>
<security />
</system>
<eventdata>
<data name="subjectusersid">s-1-0-0</data>
<data name="subjectusername">-</data>
<data name="subjectdomainname">-</data>
<data name="subjectlogonid">0x0</data>
<data name="targetusersid">s-1-5-7</data>
<data name="targetusername">anonymous logon</data>
<data name="targetdomainname">nt authority</data>
<data name="targetlogonid">0x9688d</data>
<data name="logontype">3</data>
<data name="logonprocessname">ntlmssp </data>
<data name="authenticationpackagename">ntlm</data>
<data name="workstationname">minwinpc</data>
<data name="logonguid">{00000000-0000-0000-0000-000000000000}</data>
<data name="transmittedservices">-</data>
<data name="lmpackagename">ntlm v1</data>
<data name="keylength">128</data>
<data name="processid">0x0</data>
<data name="processname">-</data>
<data name="ipaddress">10.1.240.50</data>
<data name="ipport">49412</data>
<data name="impersonationlevel">%%1833</data>
</eventdata>
</event>
session terminated:
log name: security
source: microsoft-windows-security-auditing
date: 8/30/2015 12:17:53 pm
event id: 4634
task category: logoff
level: information
keywords: audit success
user: n/a
computer: libtech
description:
account logged off.
subject:
security id: anonymous logon
account name: anonymous logon
account domain: nt authority
logon id: 0x9688d
logon type: 3
event generated when logon session destroyed. may positively correlated logon event using logon id value. logon ids unique between reboots on same computer.
event xml:
<event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<system>
<provider name="microsoft-windows-security-auditing" guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<eventid>4634</eventid>
<version>0</version>
<level>0</level>
<task>12545</task>
<opcode>0</opcode>
<keywords>0x8020000000000000</keywords>
<timecreated systemtime="2015-08-30t19:17:53.769685700z" />
<eventrecordid>7798</eventrecordid>
<correlation />
<execution processid="552" threadid="2040" />
<channel>security</channel>
<computer>libtech</computer>
<security />
</system>
<eventdata>
<data name="targetusersid">s-1-5-7</data>
<data name="targetusername">anonymous logon</data>
<data name="targetdomainname">nt authority</data>
<data name="targetlogonid">0x9688d</data>
<data name="logontype">3</data>
</eventdata>
</event>
Windows Server > Setup Deployment
Comments
Post a Comment