Windows 2019 RRAS Server unable to utilize DHCP server on same subnet to issue to RRAS clients

Question

question

Tony-2924 asked Jul 19, '20 CandyLuo-MSFT commented Jul 22, '20

Windows 2019 RRAS Server unable to utilize DHCP server on same subnet to issue to RRAS clients

Hi,

I've seen this occur twice already when setting up new Windows 2019 servers. Most recently, I introduced a new Windows 2019 to replace an older Windows 2008 R2 server as our RRAS server. Simple setup, with single domain, single subnet, one domain controller, small environment. When moving the RRAS service to the Windows 2019 server, it is not able to retrieve the IP addresses from the DHCP server to allocate to the L2TP/PPTP clients requesting them. When connecting to the server via PPTP/L2TP, the following error would appear on the Windows 2019 server:

RoutingDomainID- {00000000-0000-0000-0000-000000000000}: CoId={156257C0-6202-48A0-9E81-D3A5FCF0A2B9}: The user Domain\kevinr connected to port VPN4-79 has been disconnected because no network protocols were successfully negotiated.

RoutingDomainID- {: No IP address is available to hand out to the dial-in client

Re-installation of the RRAS server on the server did not fix it

I managed to get this to work by manually creating an IP Range within RRAS to hand out, but when doing it this way, I cannot get the appropriate DNS suffix information to be provided to the VPN clients. Thus, they can't access resources by just using the server name, they need to enter in the FQDN, which to non-technical folks, is a sheer pain for them to walk them through and correct.

So far, I've set up two Windows 2019 servers to assume RRAS services in my client environments, and this behavior has occurred on both servers. I tried moving the DHCP services on to the same server as the RRAS service on the Windows 2019 server, but that did not fix it either.

Has anyone experienced this before? I'm wondering is this is a known issue with Windows 2019 RRAS services, and wondering if MSFT has an official fix for this.

Thanks,
T

windows-dhcp-dns windows-server-infrastructure

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CandyLuo-MSFT · Jul 21, 2020 at 03:03 AM

Hi,

Just want to confirm the current situations.

Please feel free to let us know if you need further assistance.

Best Regards,
Candy

0 ·

Answer 1 · 2020-07-20T04:04:16.057Z

CandyLuo-MSFT answered Jul 20, '20 CandyLuo-MSFT edited Jul 20, '20

Hi ,

Have you received such error message in Remote Access management console? Or find ACCESS_DENIED or 0xc0000022 in RRAS log?

If yes, service hosts in SVCHOST.EXE are split into separate processes on RS3 and later versions of Windows 10 and Windows Server 2016 and all versions of Windows Server 2019 configured with more than 3.5 GB+ of RAM. Calls to DHCP client API DhcpLeaseIpAddressEx fail with ACCESS_DENIED because the DHCP Client Service process lacks the SeImpersonatePrivilege. Without this privilege, the process can not impersonate credentials.

As a workaround:

Add the SeImpersonatePrivilege to the DHCP client service and restart relevant services:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Dhcp" /v RequiredPrivileges /d "SeChangeNotifyPrivilege"\0"SeCreateGlobalPrivilege"\0"SeImpersonatePrivilege"\0 /t REG_MULTI_SZ /f

For your reference:

https://social.technet.microsoft.com/Forums/en-US/7cbce33b-fe95-4c04-929d-e9b1ed62f944/vpn-connection-fails-with-new-server?forum=ws2019

Best Regards,

Candy

3.png (85.0 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2020-07-19T21:00:18.293Z

DSPatrick answered Jul 19, '20

Might try the work-around mentioned here.
https://social.technet.microsoft.com/Forums/en-US/0270d377-be3a-4b63-82a0-9df076c5e3b3/upgrade-from-2016-to-2019-breaks-dhcp-relay-agent-when-using-rras

--please don't forget to Accept as answer if the reply is helpful--

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-07-22T06:21:00.123Z

Tony-2924 answered Jul 22, '20 CandyLuo-MSFT commented Jul 22, '20

Thanks for the feedback.

I will attempt the workaround this weekend and let you know if it works.

Thanks

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CandyLuo-MSFT · Jul 22, 2020 at 07:18 AM

We will wait for your good news.

0 ·

question