Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run Windows XP, Vista and are now testing Windows 7 in our corporate environment. Thus far all of our Win7 installations have been x64 installs with the same net result that we are having to authenticate to every corporate intranet site. Single sign on works in Firefox and all versions of IE on other OSes. Neither IE or Firefox works with single sign on in Win7 leading us to believe it is something to do with Win7.

We do not have this problem in Windows XP or Vista. Is there a setting in Win7 that allows for single sign on? Is there a domain setting specific to Win7?

share|improve this question

migrated from Aug 8 '09 at 6:42

This question came from our site for computer enthusiasts and power users.

Does your SSO system require an agent installation or is it "magic cookie" based? – Bob Aug 8 '09 at 15:32
what is "single sign on" exactly? – djangofan Nov 19 '09 at 19:22
The idea that you don't have to continually authenticate to intranet resources that require authentication. I.e. I sign on to Windows but don't have to manually pass my credentials to other network resources servers, web sites, etc. – ahsteele Nov 21 '09 at 17:38

Firefox does support NTLM authentication. Safari will, too, in the near future.

share|improve this answer
  • What browser are you using?
  • Are you being prompted for authentication for any other services (eg- mail, network shares)?
  • Are these Win7 machines joined to your AD domain?
  • If they are part of a domain, are they part of the same domain as your XP/Vista machines or are they in something like a lab domain? If in a lab domain are there full trusts between the domains?
share|improve this answer
+1. To expand on the browser note, IE is the only browser supports domain authentication. Firefox, et. al won't support it. And it sounds like a domain is indeed in place here. – EvilChookie Aug 8 '09 at 2:51

Assuming you're using IE as per squillman's answer...

... Does IE see these sites as Intranet sites as per its list of trusted zones (tools, internet options, security, select intranet zone & ensure sites are listed there)?

If IE doesn't think the site is local and you trust it, it won't send your login credentials to it, which is a good thing really.

share|improve this answer
up vote 1 down vote accepted

Our problem ended up stemming from a Local Security Policy.

Tree To Find Setting:

  • Local Security Policy
    • Local Policies
      • Security Options
        • Network Security: Configure encryption types allowed for Kerberos

Enabling all options under Network Security: Configure encryption types allowed for Kerberos did the trick.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.