Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to configure both Windows servers and workstations (Windows 7) to use only Kerberos for authentication and not use NTLM for authentication within the Domain?

I was told that Kerberos authentication fails if the target system is accessed via IP address.

Any success or failure stories out there?

share|improve this question

here's a recent article on this

sorry to link bomb and run but this does contain the answer

share|improve this answer
Hi. Thanks for the link. Unfortunately it only discusses if LM/NTLM is in use, but not if Kerberos only domain is possible. – Konrads Feb 8 '12 at 16:51
this statement from the msft guy in the blog "No, because you cannot configure a server to ignore NTLMv2." means that it won't ignore lmv2 it just might not use it, which at that point would me kerberos only. – tony roth Feb 8 '12 at 16:58
@tony_roth Thanks for pointing that out. One of the reasons I'm looking into this is to prevent replay attacks or password hash cracking. If the NTLMv2 still gets sent along, then that's bad. – Konrads Feb 8 '12 at 23:04
also will give you further info if in a win7+ enviro. Also pw hash hacking is not completely solved by kerberos, if I remember correctly. – tony roth Feb 9 '12 at 15:13
Reviewing the above articles, it is my understanding then that you can not force a server to not do NTLMv2 authentication. I understand that given the opportunity, Kerberos will be negotiated as the stronger protocol. – Konrads Feb 23 '12 at 15:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.