Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By default in IIS7, Windows Authentication was turned off and I had to make a configuration change to activate it. When I did that there was a description for Windows Authentication that explained this should only be used for intranet sites, not public facing websites. When you consider NTLM/Kerberos does not use plain text I am not sure why Microsoft have decided this, all of a sudden.

Can anybody explain?

share|improve this question
up vote 1 down vote accepted

Windows Authentication when enabled allows the Web Site to be authenticated using NTLM or Kerberos. By default, WIA enables Kerberos starting from Win2K. When you enable WIA basically you expose your AD to the Internet to allow Internet users to authenticate.

Microsoft documentation says you enable Basic + SSL when exposing your application over Internet. Also, check out the articles which explains the changes implemented in Authentication from Windows Server 2008 R2. link text and link text

share|improve this answer
If you have remote desktop enabled on the server surely you already have your AD exposed to the internet? What's the difference or am I missing something? – user38553 Jun 7 '10 at 8:42
... and why is it bad to expose your AD to the internet? – user38553 Jun 7 '10 at 8:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.