We run Windows XP, Vista and are now testing Windows 7 in our corporate environment. Thus far all of our Win7 installations have been x64 installs with the same net result that we are having to authenticate to every corporate intranet site. Single sign on works in Firefox and all versions of IE on other OSes. Neither IE or Firefox works with single sign on in Win7 leading us to believe it is something to do with Win7.

We do not have this problem in Windows XP or Vista. Is there a setting in Win7 that allows for single sign on? Is there a domain setting specific to Win7?

migrated from superuser.com Aug 8 '09 at 6:42

This question came from our site for computer enthusiasts and power users.

  • Does your SSO system require an agent installation or is it "magic cookie" based? – Bob Aug 8 '09 at 15:32
  • what is "single sign on" exactly? – djangofan Nov 19 '09 at 19:22
  • The idea that you don't have to continually authenticate to intranet resources that require authentication. I.e. I sign on to Windows but don't have to manually pass my credentials to other network resources servers, web sites, etc. – ahsteele Nov 21 '09 at 17:38

Firefox does support NTLM authentication. Safari will, too, in the near future.

  • What browser are you using?
  • Are you being prompted for authentication for any other services (eg- mail, network shares)?
  • Are these Win7 machines joined to your AD domain?
  • If they are part of a domain, are they part of the same domain as your XP/Vista machines or are they in something like a lab domain? If in a lab domain are there full trusts between the domains?
  • +1. To expand on the browser note, IE is the only browser supports domain authentication. Firefox, et. al won't support it. And it sounds like a domain is indeed in place here. – EvilChookie Aug 8 '09 at 2:51

Assuming you're using IE as per squillman's answer...

... Does IE see these sites as Intranet sites as per its list of trusted zones (tools, internet options, security, select intranet zone & ensure sites are listed there)?

If IE doesn't think the site is local and you trust it, it won't send your login credentials to it, which is a good thing really.


Our problem ended up stemming from a Local Security Policy.

Tree To Find Setting:

  • Local Security Policy
    • Local Policies
      • Security Options
        • Network Security: Configure encryption types allowed for Kerberos

Enabling all options under Network Security: Configure encryption types allowed for Kerberos did the trick.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.