ADFS authentication issues with users from trusted domain
We manage a forest / domain (domain1.com) that has a two way trust with a company we recently merged with (domain2.com).
ADFS is on-premises and resides in domain1.com
User's in domain1 have not issues logging on, user's in domain2 are experiencing authentication issues.
Does ADFS support multiple domains?
Any configuration required with ADFS to enable the support multiple domains?
If you look at the event viewer, the following event is generated, I'm not sure what that means.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: xxxxxx
Account Domain: XXX
Failure Information:
Failure Reason: An Error occurred during Logon.
Status: 0xC000035B
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: XXXX
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process:
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
Status code 0xC000035B is an error message that occurs when the LmCompatibility registry value is configured to force the system to use NTLMv1. An LmCompatibility value of fewer than 3 forces the system to use NTLMv1. Because channel bindings aren't sent when NTLMv1 is used, the authentication fails and generates the 0xC000035B "Client's supplied Security Support Provider Interface (SSPI) channel bindings were incorrect" error message.