Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The first version of Exchange 2010 to support Kerberos is SP1 RU3. It does this through the RollAlternateServiceAccountCredential.ps1 commandlet.

Besides implementing "better" security, does this offer any other benefits for disaster recovery, performance, or anything else worth knowing?

FYI - in case Google sends you here:

The way to determine if Kerberos is being used, use KList.exe in conjunction with

Test-OutlookConnectivity -Identity administrator -MailboxCredential $c -Protocol tcp
share|improve this question
up vote 2 down vote accepted

By my read of it, this will provide two things:

  1. If you're using a CAS Array, clients will authenticate faster since they won't have to fail-back past Kerberos to NTLM anymore.
  2. Kerberos is generally considered more secure than NTLM, so overall security should be improved.

I don't believe it offers any benefits to disaster recovery, just initial-connection performance and possibly reduced log-spam.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.