use only NTLM as authentication method in windows server 2008

Hi!

When connecting to server resource from clinet use IP number instead of SPN and Kerberos will not be used.

HTH

Toni

what I am asking is how to specify/configure NTLM to be the only authentication method used instead of tricking the system into the NTLM fall back mechanism. Thanks anyway for trying to help,

To configure which computers to use only NTLM? Kereberos is default authentication method since Windows 2000 and can not be fully disabled in Active Direcotry domain.

Hi Tony, thanks for the reply. I mean to configure the server to use only NTLM for authentication.

What I really care is to have NTLM only between an Outlook client and Exchange Server.
On the Outlook, I can select "Negotiated" to be used, the exchange default is "Windows Integrated".
If I don't do anything, Kerberos is used.

What I need to know is this: if I set "Netgotiated" on the outlook client, can I get Exchange to talk NTLM instead of Kerberos, Assuming SPN is used by the client Windows PC, not IP addresses.

Thanks again for your interest and  replies,
/Raymond

Then you should reconfigure Outlook to use NTLM. Open Outlook go to Tools, Accounts settings..., select your account, click Change..., click More Settings... button, go to Security tab and select NTLM.

Is there anyway we can enforce NTLM from the Exchange server instead of from the client?

Thanks,
/Raymond

Somehow I knew that this would be your next question. ;) There is an utility in Resource Kit 2003 called "setspn". If you run it from command prompt with -l switch and exchange server name you will see a list of SPNs, some of them are registered by Exchange. You could try to remove some of them or (as I believe) at least prevent clients to contact global catalog (remove SPN for GC). Of course I have emphasise that you shouldn't do this unless you are conducting tests in lab environment.

thanks, Tony, basically this is to block Kerbero to trick the server to fall back to NTLM.

How do I remove the SPNs once I figured them out with "setspn -l"

/Raymond

To remove SPN records use "setspn -r".

"Setspn Overview"
http://technet.microsoft.com/en-us/library/cc773257(WS.10).aspx

Of course, if I'm not mistaken, Exchange System Attendant service will re-register them. Reconfiguring your clients would be proper way of changing authentication method. Group Policy with administrative templates for Office should make this change easy to enforce on all clients.

Hi Tony, thanks again for all you helpful answers, is there any way I can turn of the re-register of SPNs by the Exchange System Attendant service?

/Raymond