密码更改后，WCF服务上的Windows身份验证失败

Question

We have a windows service hosting some wcf web services that are authenticated with wsHttpBindings. A user experienced authentication issues and it turned out her password had expired. She then changed her password and restarted the computer. After this password change she was no longer able to access the web services. She received

System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.

On the server we had service tracing enabled and the error appears when the user attempted to call the service:

System.ComponentModel.Win32Exception (0x80004005): The Security Support Provider Interface (SSPI) negotiation failed.

We then checked the Windows Logs -> Security in Event View on the server and find

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       user@compyany.com
    Account Domain:     

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc0000064

We have tried resetting her password again but that did not help.

Answer 1

Control Panel -> User Accounts -> Manage your credentials -> Windows Credentials

There was one entry in the list which was to the server we had problems accessing. We deleted it and the user was able to access the service without issue.

It seems that the user had accessed the server using mstsc or similar and entered a upn username format user@company.com and saved the password. This did not get updated when she changed her password and for some reason wcf uses these credentials when accessing the service instead of the default.