1

We run Windows XP, Vista and are now testing Windows 7 in our corporate environment. Thus far all of our Win7 installations have been x64 installs with the same net result that we are having to authenticate to every corporate intranet site. Single sign on works in Firefox and all versions of IE on other OSes. Neither IE or Firefox works with single sign on in Win7 leading us to believe it is something to do with Win7.

We do not have this problem in Windows XP or Vista. Is there a setting in Win7 that allows for single sign on? Is there a domain setting specific to Win7?

3
  • Does your SSO system require an agent installation or is it "magic cookie" based?
    – Bob
    Aug 8, 2009 at 15:32
  • what is "single sign on" exactly?
    – djangofan
    Nov 19, 2009 at 19:22
  • The idea that you don't have to continually authenticate to intranet resources that require authentication. I.e. I sign on to Windows but don't have to manually pass my credentials to other network resources servers, web sites, etc.
    – ahsteele
    Nov 21, 2009 at 17:38

4 Answers 4

2

Assuming you're using IE as per squillman's answer...

... Does IE see these sites as Intranet sites as per its list of trusted zones (tools, internet options, security, select intranet zone & ensure sites are listed there)?

If IE doesn't think the site is local and you trust it, it won't send your login credentials to it, which is a good thing really.

2

Firefox does support NTLM authentication. Safari will, too, in the near future.

1
  • What browser are you using?
  • Are you being prompted for authentication for any other services (eg- mail, network shares)?
  • Are these Win7 machines joined to your AD domain?
  • If they are part of a domain, are they part of the same domain as your XP/Vista machines or are they in something like a lab domain? If in a lab domain are there full trusts between the domains?
1
  • +1. To expand on the browser note, IE is the only browser supports domain authentication. Firefox, et. al won't support it. And it sounds like a domain is indeed in place here. Aug 8, 2009 at 2:51
1

Our problem ended up stemming from a Local Security Policy.

Tree To Find Setting:

  • Local Security Policy
    • Local Policies
      • Security Options
        • Network Security: Configure encryption types allowed for Kerberos

Enabling all options under Network Security: Configure encryption types allowed for Kerberos did the trick.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .