This article addresses the issue of users being unable to authenticate to Okta using Delegated Authentication with Active Directory (AD). Additional error messages are also received in the Windows Event log.
FAILURE: Group Membership Unchanged
FAILURE: login failed
The error code in the System Log entry is 1385:
Logon failure: the user has not been granted the requested logon type at this computer.
The errors shown in the AD Agent's Windows server side (Event Viewer > Windows Log > Security) are as below:
- Directory Integrations
- Active Directory
- Delegated Authentication
The following System Log search query will determine if the issue is present:
eventType eq "user.authentication.auth_via_AD_agent" and debugContext.debugData.errorCode eq "1385"
The 1385 error code is provided when the user has yet to be granted the requested logon type for the Okta Active Directory Agent server.
Additional information can be found on Microsoft's site.
To remediate this issue, the user must be allowed to log in locally to the Okta AD Agent servers. The permission can be granted through Group membership or individually. If the user is a member of a group already assigned, there is an issue with the AD User object. Adding the user individually may resolve the issue.
To allow local login access to the AD Agent server, perform the following steps:
- Open Start menu > type gpedit.msc.
- Under Computer configuration, go to Windows Settings > Security Settings > Local Policies > User Rights Assignments.
- Right-click on Allow log on locally > Properties.
- Click Add User and Group, then add the new user account.
NOTE:
- In step 3, the permission can be Access this computer from the network or Allow log on locally. It does not need to be both. However, any explicit deny policy for the user is always honored in AD before any allow policy.
- These steps will need to be performed on all AD Agent servers. Therefore, as described in the Microsoft articles mentioned in the Related References section, the administrator should review "Risky configuration" and "Reasons to grant this user right" and set the appropriate permissions.
Please consult the Active Directory team or Microsoft for additional assistance if the issue persists.
