Regresar
-
Título
Error: "Authentication Rejected (Failed to read token data)" after restoring an AD User -
Descripción
An AD user was mistakenly deleted and then restored from a backup. After the restore, the AD account works, but the user is no longer able to authenticate with their Defender token. User also receives the same error when a new token is programmed. The following is shown in the DSS Audit Log (time stamps and username removed):LDAP failed (-1) getting token data forReason: Failed to read token data Session ID: D3B61F75B287D238Radius response: Authentication Rejected (Failed to read token data) User-Name: <TokenUser> -
Causa
When viewing the Defender tab of the User Properties in Active Directory Users and Computers, it may appear that all tokens have been unassigned from the user, however, when viewing the Attribute Editor tab, the "defender-userTokenData" attribute still contains data. This is likely related to the user restore process. This attribute will need to be cleared, and a new token programmed to resolve the issue. -
Resolución
To clear the attribute data using a PowerShell command.
Warning: This section, method, or task contains steps that tell you how to modify Active Directory objects. Serious problems might occur if you these commands are not executed incorrectly. Ensure that you follow these steps carefully. Refer to the Microsoft PowerShell documentation for more information on the commands below.
First, you can view the current data by running the following command:
Get-ADUser -Identity <username> -Property defender-userTokenData | Select -ExpandProperty defender-userTokenData
Next, you can clear the value of this attribute by running this command:
Set-ADUser -Identity <username> -Clear "defender-userTokenData"
Once the attribute data has been cleared, assign a new token by either using the Token Programming Wizard in ADUC, or by having the user request a token using the Defender Self Service Portal. After the new token has been activated, it should now be possible for the user to log on successfully.