Windows – Server impersonation – Target account name is incorrect

hosts-fileredirectionwindows

I am setting up a test Windows 7 workstation in my environment, which I have named DevWS1. This machine needs to be able to connect to development data while looking like it's in the live side of things. For the most part I have this working, but not for file shares. Here's the scenario:

The two production file servers I need to impersonate are \Server1\Share1 and \Server2\Share2. I have set up hosts-file redirects so that their DNS names point back to the local machine, and shared two folders on the C Drive with the same names. I have also disabled strict name checking. The host file on my workstation has this added to it

 127.0.0.1 Server1 Server2

In essence what I want to happen is the following:

  1. \\Server1\Share1 -> \\localhost\Share1 — This one works
  2. \\Server2\Share2 -> \\localhost\Share2 — This one does NOT

When attempting to connect to the second fake share, I get the following error: "Login Failure: The target account name is incorrect"

It is absolutely vital that I do not modify any live infrastructure, including DNS, settings on the two real fileservers (which are obviously still in service) or any other non-local setting.

It is also critical that this be mostly transparent to the application under test. It needs to be able to call \\Server1\Share1\File1.txt and get that file, just from the local share instead of the real fileserver.

Best Answer

I managed to solve this myself by reading the following article

https://4sysops.com/archives/disable-strict-name-checking-with-powershell/

Specifically, I did this:

  1. Added the multi-string registry item "BackConnectionHostNames" to HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 and added the names of the servers I wanted to impersonate, and their FQDNs.
  2. Added the multi-string registry item "BackConnectionHostNames" to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters and added the names of the servers I wanted to impersonate WITHOUT their FQDNs.
  3. Added the DWORD "DnsOnWire" to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters with a value of 1.

This seems to have resolved the issue I was seeing.

Related Topic