Solved

Kerberos / NTLM

Posted on 2016-07-26
3
69 Views
Last Modified: 2016-08-05
Hello

I have a website that seems to configure to use Kerberos. I see this as negotiate is selected but I know that is not enough.

Regardless I would like to bypass Kerberos Auth ( to avoid any misconfigure SPN etc ) and connect with NTLM so that I can be sure that site is configured correctly.

I move the MTLM above the negotiate but I am still having the same error popping up credential window and after 3 attempts it gives no authorized access error that seems to me a Kerberos error behavior

I have been wondering if there is anything else I need to consider to bypass Kerberos and to force NTLM

and How do you figure out if a site is using Kerberos except checking for the Authentication setting to see negotiate is on top. I Know that you can use Wireshark etc but I need a simple way . I can check the security log and see Kerberos in security audit logs but there is more than one site on the server. So how would I know whether or not a particular site is using Kerberos but not NTLM ?

Thanks All

F.
0
Comment
Question by:toronto2456
  • 2
3 Comments
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 41735494
Switching to NTLM will most likely not solve your issue.  Its probably a site config problem.

First thing is to make sure that if Windows Authentication is enabled, that you disable Anonymous Authentication.  Anonymous will hit first if both are enabled.

I would read thru this blog post and verify your setup.

Link:  https://blogs.msdn.microsoft.com/chiranth/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis/

Unless you are using custom DNS names, you should not have the fiddle with SPNs.

Dan
0
 

Author Comment

by:toronto2456
ID: 41738958
Thanks Dan,

Yes, I have checked those. I have also checked for duplicate SPN. The only thing seems to be missing SPN for File shares.

custom DNS names are being used so need fo SPNs. Our contents are located in UNC Share on aNAS ,WEBSITESCONTENT, which is DNS alias for CORPDATA.HERCULES.tor.on.

Do you know what SPN needs to be created in this case.  I have checked web but found many different answers.

I think the problem is the missing SPN for NAS shares as I have been having security policy errors

Thanks

F.
0
 
LVL 27

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 41742637
Yeah, but you are accessing the content on the NAS via IIS, therefore the URL to use is the URL of hte IIS server, not the FQDN of the NAS device.

You can configure a website to source its content from the UNC Share.

Link:  https://msdn.microsoft.com/en-us/library/cc768023.aspx?f=255&MSPPError=-2147217396

Dan
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Running classic asp applications under Windows Server 2008 R2 (x64) and IIS 7 is not as easy as one may think. It took me a while to figure it out while getting error 8002801d a few times. After you install the OS you will need to install the fol…
Prologue It is often required to host multiple websites on a single instance of IIS, mostly in development environments instead of on production servers. I am sure it is not much a preferred solution on production servers but this is at least a pos…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question