Active Directory - Protected Users cannot logon anymore with SamAccountName after forest and domain functional level update

[Jean-Mi Jac]

Hello,We recently raised our forest and domain functional levels (single domain forest) from Windows 2012R2 to Windows 2016Since then, all the accounts present in Protected users group cannot logon anymore using the pre-Windows 2000 logon name (the "old" fashioned %Domain%\%SamAccountName% login). When we try to login via RDP we get following message:. “A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support.”When we try to login on vCenter, Linux or web-based application,

Continue reading...