ADFS authentication issues with users from trusted domain

Daniel Andryszak 121 Reputation points
2025-04-16T20:06:49.9766667+00:00

We manage a forest / domain (domain1.com) that has a two way trust with a company we recently merged with (domain2.com).

ADFS is on-premises and resides in domain1.com

User's in domain1 have not issues logging on, user's in domain2 are experiencing authentication issues.

Does ADFS support multiple domains?

Any configuration required with ADFS to enable the support multiple domains?

If you look at the event viewer, the following event is generated, I'm not sure what that means.

An account failed to log on.

Subject:

           Security ID:                         NULL SID

           Account Name:                 -

           Account Domain:                              -

           Logon ID:                             0x0

Logon Type: 3

Account For Which Logon Failed:

           Security ID:                         NULL SID

           Account Name:                 xxxxxx

           Account Domain:                              XXX

Failure Information:

           Failure Reason:                 An Error occurred during Logon.

           Status:                                  0xC000035B

           Sub Status:                         0x0

Process Information:

           Caller Process ID:              0x0

           Caller Process Name:      -

Network Information:

           Workstation Name:         XXXX

           Source Network Address:             -

           Source Port:                       -

Detailed Authentication Information:

           Logon Process:                  

           Authentication Package:               NTLM

           Transited Services:          -

           Package Name (NTLM only):        -

           Key Length:                        0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

Status code 0xC000035B is an error message that occurs when the LmCompatibility registry value is configured to force the system to use NTLMv1. An LmCompatibility value of fewer than 3 forces the system to use NTLMv1. Because channel bindings aren't sent when NTLMv1 is used, the authentication fails and generates the 0xC000035B "Client's supplied Security Support Provider Interface (SSPI) channel bindings were incorrect" error message.

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
4,063 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.