I have a problem with NTLM single-sign-on with IE8.
We've got multiple domain controllers and users from multiple domains that we try to authenticate to a web application via NTLMv1 passthru.
Somehow IE fails to send the user's domain in the NTLM Type 1 message. This has the effect that the webapp can not match users properly to their domain controllers, resulting in failed logon attempts, because a user from domain X tries to authenticate to domain controller Y.
This problem does not occur with Firefox, as it always sends the correct domain header.
So: how do I get IE to send the domain in the NTLM header?