0

My network administrator would like to switch Active Directory from mixed mode to native mode and has asked me if that would affect our primary Windows Form application. The application accesses AD through the .NET security principal API:

var principal = new WindowsPrincipal(WindowsIdentity.GetCurrent());

and then tests principal.IsInRole to determine the user's role. I'm almost 100% sure the change to native mode wouldn't affect this app. but it's not something we can test and from what I've read it's not possible to switch it back to mixed mode should something go awry.

I'd like some reassurance so that I can give him the go-ahead to make the switch.

Improve this question
2
  • 1
    Might want to try posting this on stackoverflow.com instead. Might be something that another programmer might have already dealt with.
    – Brian Knoblauch
    May 5, 2009 at 12:59
  • Mind marking this as answered?
    – aharden
    Aug 4, 2009 at 20:30

4 Answers 4

Reset to default
1

I can't give you a straight answer - I'm a newcomer to .NET stuff ATM. I'm sorry I can't do more.

However, I can tell you this - the switch to native mode eliminates compatibility support for prior versions of AD authentication. So, if you're going from NT4 to 2000 (the first generation of this type of issue) and your authentication is not based on 2000 AD, then yes, it would break. I suspect you're probably on 2003 or 2008, and 2003's native mode is yet another step up from 2000 (a.k.a. mixed mode is 2000+2003 support but no NT4 support), so the move to native would be all-2003 authentication, am I right? And there lies the rub - if your application is authenticating against a 2003 server properly, you're probably fine.

Expensive proposition: use two virtual machines, one running 2003 and the other a client OS with your app, and authenticate. Make sure that 2003 is running in full native mode. That should answer your question definitively.

Improve this answer
2

Mixed Mode versus Native Mode is all about domain controller OS compatibility. Mixed Mode allows NT4 domain controllers to co-exist in a Windows 2000 domain. Native mode requires all Windows 2000 (or greater) domain controllers. NTLM authentication is not lost when you convert to Native mode. Here's a good primer on the subject circa 1999: Mixed Mode versus Native Mode.

As Windows Server has evolved, the number of AD functional levels has increased with each new major release. In addition to Mixed Mode and Native Mode, there are also Windows Server 2003 Compatibility Mode and Windows Server 2008 Compatibility Mode. As the names imply, these modes enable newer AD functionality to be turned on when all DCs are at the corresponding OS level or higher and the domain and/or forest functional levels are upgraded.

Improve this answer
1

I'm a developer and that line of code will not be affected by going to native mode. However preferably you would have a tst forest to test these types of changes in.

Improve this answer
0

You need to test this.

There are other scenarios where switching away from native mode and disabling legacy Windows authentication methods may present a problem. We did this several years ago, and several applications that users considered important had problems because they were using insecure NTLM hashes.

That was 2004, hopefully apps are better today, but I'd still recommend testing everything you can.

Improve this answer
1
  • This shouldn't have been affected by a switch to native mode. It's more about what objects are replicated, etc. Likely they did some other things like disable LM Hashes, upgrade the NTLM security mode, enable RestrictAnonymous, etc.
    – K. Brian Kelley
    May 8, 2009 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .