Solved

Kerberos / NTLM

Posted on 2016-07-26
3
74 Views
Last Modified: 2016-08-05
Hello

I have a website that seems to configure to use Kerberos. I see this as negotiate is selected but I know that is not enough.

Regardless I would like to bypass Kerberos Auth ( to avoid any misconfigure SPN etc ) and connect with NTLM so that I can be sure that site is configured correctly.

I move the MTLM above the negotiate but I am still having the same error popping up credential window and after 3 attempts it gives no authorized access error that seems to me a Kerberos error behavior

I have been wondering if there is anything else I need to consider to bypass Kerberos and to force NTLM

and How do you figure out if a site is using Kerberos except checking for the Authentication setting to see negotiate is on top. I Know that you can use Wireshark etc but I need a simple way . I can check the security log and see Kerberos in security audit logs but there is more than one site on the server. So how would I know whether or not a particular site is using Kerberos but not NTLM ?

Thanks All

F.
0
Comment
Question by:toronto2456
  • 2
3 Comments
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 41735494
Switching to NTLM will most likely not solve your issue.  Its probably a site config problem.

First thing is to make sure that if Windows Authentication is enabled, that you disable Anonymous Authentication.  Anonymous will hit first if both are enabled.

I would read thru this blog post and verify your setup.

Link:  https://blogs.msdn.microsoft.com/chiranth/2014/04/17/setting-up-kerberos-authentication-for-a-website-in-iis/

Unless you are using custom DNS names, you should not have the fiddle with SPNs.

Dan
0
 

Author Comment

by:toronto2456
ID: 41738958
Thanks Dan,

Yes, I have checked those. I have also checked for duplicate SPN. The only thing seems to be missing SPN for File shares.

custom DNS names are being used so need fo SPNs. Our contents are located in UNC Share on aNAS ,WEBSITESCONTENT, which is DNS alias for CORPDATA.HERCULES.tor.on.

Do you know what SPN needs to be created in this case.  I have checked web but found many different answers.

I think the problem is the missing SPN for NAS shares as I have been having security policy errors

Thanks

F.
0
 
LVL 27

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 41742637
Yeah, but you are accessing the content on the NAS via IIS, therefore the URL to use is the URL of hte IIS server, not the FQDN of the NAS device.

You can configure a website to source its content from the UNC Share.

Link:  https://msdn.microsoft.com/en-us/library/cc768023.aspx?f=255&MSPPError=-2147217396

Dan
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

What is an ISAPI filter?   •      It's an assembly (.dll file) that can add or change the way IIS works.   •      They can be enabled globally for your web server or on a site-by-site basis.   When the IIS server receives a request, enabling the ISAPI fi…
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used.

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question