Windows AD authentication fails with FWM00006 error

We can log into the CCM on our BO 4.2 server with Windows Authentication. When we try to log into CMC. we get:

Account information not recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserName@DNS_DomainName, and then try again. (FWM 00006)

Suggestions?