

If password auth or `passwd -R' auth is used you'll have the "4(INTERACTIVE)" group in your `id' output.  If S4ULogon is used you'll have the "2(NETWORK)" group in your `id' output.  This is one way to identify which logon method has been used.

	>>>>I always get 4(INTERACTIVE) - with password or with RSA (also on servers I didn't run passwd -R). Never got 2(NETWORK).



You don't need mkpasswd anymore.  Use `getent passwd' instead.
But... given you're using mkpasswd at all, I wonder if you still have /etc/passwd and/or /etc/group files.  If so, move them out of the way and restart your CYgwin processes.  They are not required and may even result in problems if they have been tweaked.
If you still have these files, removing them is the first thing to try.

	>>>>Yes, I still have passwd and group files. No special tweaks. They were set with mkpasswd -d & mkgroup -d and never been touched, but I'll check how to use getent and will update.



Other groups than NETWORK or INTERACTIVE don't matter, as explained above.  The only reasons I can think of that LogonUser doesn't work is that your username, domainname, or password are incorrect, or your account is disabled.  I never saw the call fail for any other reason.
For debugging, you would have to call the sshd service under strace.
That would give a hint.  For that you should change the sshd service call in the registry so that `/usr/sbin/sshd -D' is replaced with `/usr/bin/strace -o /tmp/sshd.trace /usr/sbin/sshd -d'.  Note the lowercase -d, which runs sshd in debug mode.  After the first logon, sshd will terminate itself automatically.  Afterwards you should send the /tmp/sshd.trace file here for inspection.  You can obfuscate sensitive info, but the gist of the file should stay intact.

	>>>> I was able to set sshd to run with debug (-d), but when adding the trace the service fails to start. 


Noticed another problem started only on the servers I ran passwd -R - the Cygwin terminal fails to start. The window opens and closes immediately. It didn't happen immediately after running the command. It started a few days later.
Servers have been rebooted during this time and I think it started after the reboot.
Think I might need to reinstall or upgrade and try your suggestions again.


Thanks for the tips. I will update when I have more info.
 Ð¢ÒÐÐ¥&ö&ÆVÒ&W÷'G3¢‡GG¢òö7–wv–âæ6öÒ÷&ö&ÆV×2æ‡FÖÀÐ¤d¢‡GG¢òö7–wv–âæ6öÒöfðÐ¤Fö7VÖVçFF–öã¢‡GG¢òö7–wv–âæ6öÒöFö72æ‡FÖÀÐ¥Vç7V'67&–&R–æfó¢‡GG¢òö7–wv–âæ6öÒöÖÂò7Vç7V'67&–&R×6–×ÆPÐ Ð