Cisco Systems Servers Benutzerhandbuch

The scenario given above is handled differently if the user accounts with 
identical usernames exist in separate Windows domains. For more 
information, see the 

Because it is a native Windows NT/2000 application, Cisco Secure ACS treats 
authentication with a Windows NT/2000 user database as a special case. Windows 
can provide added functionality to the remote access authentication process. 
Perhaps the most important aspect of this added functionality is support for 
multiple occurrences of the same username across the trusted domains against 
which Cisco Secure ACS authenticates access requests.

Cisco Secure ACS communicates with the Windows NT/2000 operating system 
of the Cisco Secure ACS server to perform authentications. Windows NT/2000 
uses its built-in facilities to forward the authentication requests to the appropriate 
domain controller. There are two possible scenarios to consider:

Authentication requests in which the domain name is supplied

Authentication requests in which the domain name is omitted

When a domain name is supplied as part of a authentication request, 
Cisco Secure ACS detects that a domain name was supplied and tries the 
authentication credentials against the specified domain. The dial-up networking 
client provided with Window NT/2000 and Windows 95/98 differ in the method 
by which users can specify their domains. For more information, see the 

If the domain controller rejects the authentication request, Cisco Secure ACS logs 
the request as a failed attempt.

 Specifying the domain name allows Cisco Secure ACS to differentiate a user 
from multiple instances of the same username in different domains. For unknown 
users who provide a domain name and who are authenticated by a Windows