SoftEther VPN AD身份验证仅适用于通配符用户

Question

我在SBS2011上使用SBS2011，使用L2TP/IPSec协议。我最初的客户端是带有内置L2TP/IPSec协议的Windows 10。

在我的SoftEther用户中，如果我添加一个通配符(*)用户，并选择"NT域身份验证“，我的用户就能够连接。注意，在客户端上，用户是在没有任何域信息的情况下指定的。SoftEther设置了一个默认的集线器，所以用户名不需要指定集线器名就可以工作。

在这个配置中，通过通配符用户，我的安全日志显示.

2018-11-22 15:42:42.059 The connection "CID-65-75130DACDA" (IP address: 79.77.X.X, Host name: 79-77-xxx-x.dynamic.dsl.as9105.com, Port number: 1701, Client name: "L2TP VPN Client - Microsoft", Version: 4.28, Build: 9669) is attempting to connect to the Virtual Hub. The auth type provided is "External server authentication" and the user name is "vluk\spencer.wood".
2018-11-22 15:42:42.059 Connection "CID-65-75130DACDA": Successfully authenticated as user "domain\domainuser".
2018-11-22 15:42:42.059 Connection "CID-65-75130DACDA": The new session "SID-DOMAIN\DOMAINUSER-[L2TP]-12" has been created. (IP address: xx.xx.237.6, Port number: 1701, Physical underlying protocol: "Legacy VPN - L2TP")
2018-11-22 15:42:42.059 Session "SID-DOMAIN\DOMAINUSER-[L2TP]-12": The parameter has been set. Max number of TCP connections: 1, Use of encryption: Yes, Use of compression: No, Use of Half duplex communication: No, Timeout: 20 seconds.
2018-11-22 15:42:42.059 Session "SID-DOMAIN\DOMAINUSER-[L2TP]-12": VPN Client details: (Client product name: "L2TP VPN Client - Microsoft", Client version: 428, Client build number: 9669, Server product name: "SoftEther VPN Server (64 bit)", Server version: 428, Server build number: 9669, Client OS name: "L2TP VPN Client - Microsoft", Client OS version: "-", Client product ID: "-", Client host name: "pcname.hostname", Client IP address: "xx.xx.237.6", Client port number: 1701, Server host name: "192.168.X.X", Server IP address: "192.168.X.X", Server port number: 1701, Proxy host name: "", Proxy IP address: "0.0.0.0", Proxy port number: 0, Virtual Hub name: "VPN", Client unique ID: "04CB9F2131DABA5XXXXF85C77D68E48D")

如果删除通配符用户并添加一个名为"domainname“的特定用户，则该用户无法连接。

2018-11-22 15:43:38.344 The connection "CID-66-5B8386C5FC" (IP address: 79.77.X.X, Host name: 79-77-X-X.dynamic.dsl.as9105.com, Port number: 1701, Client name: "L2TP VPN Client - Microsoft", Version: 4.28, Build: 9669) is attempting to connect to the Virtual Hub. The auth type provided is "External server authentication" and the user name is "domain\domainuser".
2018-11-22 15:43:38.344 Connection "CID-66-5B8386C5FC": User authentication failed. The user name that has been provided was "domain\domainuser".

用户是否需要属于域上的特定组？我不会这么想的，因为当通过通配符进行身份验证时，同样的用法是不可能的。

我可能做错了什么？

Answer 1

获得"Tumbleweed“徽章促使我发布我自己的答案(或者更确切地说，非最佳的解决办法)。

该问题是由于试图通过VPN连接的用户以非管理员用户身份登录到PC。一旦我把他们的帐户换成了当地的管理员，一切都很顺利。

我无法给出一个合理的解释，特别是为什么它的非管理用户工作，只要他们是由一个softEther通配符用户认证。

如果有人能解释的话，我会改变接受的答案。