Troubleshooting: Cannot move past NTLM login screen when the user is part of a Domain Local AD Group

News Knowledge Base
1

User cannot login using DOMAIN\USERNAME if he is part of a Domain Local usergroup. How to solve it?

Problem

User cannot login using DOMAIN\USERNAME if he is part of a Domain Local usergroup.

Cause

AD limitation

Workaround

Use the USERNAME@DOMAIN

Solution

Promote group to Universal or Global.

Replicating

  1. Create an AD Group of the type Security > Domain Local

  2. Add one user to the Group 

  3. Import the Group into Orchestrator

  4. Try to login using DOMAIN\USERNAME

  5. Fail!

  6. Try to login using USERNAME@DOMAIN

  7. Success!