55 votes

RDP error "The function requested is not supported" after enabling NLA

I had the same issue. I found the issue has to do with a Windows Update patch that was pushed out to my work station in last nights Windows Updates. There was a critical CVE (CVE-2018-0886) for RDP ...
Joshua Michael's user avatar
7 votes

Hardening a file-serving Windows Server 2019 instance

First of all, reinstall the server, because : This one might be compromised and can't be trusted anymore. Windows is secure by default, and maybe someone lowered the security settings of your server, ...
Swisstone's user avatar
  • 6,880
5 votes

How can I check if my IIS site is using NTLM or Kerberos?

If you have access to your IIS server then the answer is much simpler than inspecting HTTP traffic: Simply view the site Authentication module config for Windows Authentication. In IIS Manager ...
JohnC's user avatar
  • 2,644
5 votes

Office365 NTLM authentication

No, you cannot. O365 uses modern claims based auth, so WS* and SAML. Possibly OAUTH or OPENID too. If you have on-prem AD, ADFS, you can probably auth to that, and get a token to pass to O365.
markgamache's user avatar
3 votes

FreeRADIUS using Active Directory integration broken without any traces

Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and ...
Matthew Newton's user avatar
2 votes
Accepted

Authenticate NTLM at reverse proxy in front of unauthenticated web servers

I ended up with 2 viable solutions to this problem. Hopefully this will be helpful to anyone trying to setup something similar. Set up IIS with ARR (Application Request Routing) and enable Windows ...
getsauce's user avatar
  • 101
2 votes
Accepted

Looking for a lightweight NTLM HTTP proxy server

Just stumbling upon your question. We too had to test against a NTLMv2 capable http proxy (from Java). In the end, we used a product called WinGate, which is free up to some users. We just installed ...
beat's user avatar
  • 136
2 votes
Accepted

How do you enable ntlm v3 on windows server 2008 on IIS?

I do NTLM stuff all day and I can assure you,there is is no such thing as NTLMv3. Depending on your boss, you can mock her/him, or ask for more details and see what happens. Ask why. :-P Maybe he/...
markgamache's user avatar
2 votes

Vagrant behind NTLM proxy on windows - guest unable to connect to the host proxy

I also tried the links you did with no luck, then I came across: Using vagrant with cntlm proxy. The mistake we both made was to use the HOST only network (e.g. 192.168.33.*) We want to access the ...
Reuben Peter-Paul's user avatar
2 votes

RDP error "The function requested is not supported" after enabling NLA

I had the same issue with a remote VM, with only RDP access. This worked for me... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters] "...
David Hahn's user avatar
2 votes

RDP error "The function requested is not supported" after enabling NLA

See Windows RDP: ‘An authentication error has occurred’ This is happening after you have a applied a windows security update it was this security update. It also tells you how to change your GPOs ...
Pete Long's user avatar
2 votes

IIS and HttpListener (.NET) with windows authentication

I have an explanation for this, you are attempting to achieve Single Sign On (SSO) using the negotiate / integrated windows authentication mechanism. This will not work with the Local Security ...
EPJK1337's user avatar
2 votes

NTLM authentication module mod_auth_ntlm_winbind for Apache2 omits domain name

Ok, I've found a solution. The deal is configuration of mod_auth_ntlm_winbind's underlying mechanism, winbind. It is a part of Samba and uses it's config file. In my cases there was option "winbind ...
SniperJoe95's user avatar
2 votes

Is there any working Apache module to implement NTLM on Ubuntu Server

Since 2010, Microsoft no longer recommends NTLM in applications. NTLM does not support any recent cryptographic methods, such as AES or SHA-256. It uses cyclic redundancy check (CRC) or message ...
Esa Jokinen's user avatar
  • 49.7k
1 vote
Accepted

Problems accessing shared folder in Windows clustered file Server 2008 R2

OP reports: "The problem has been solved. I asked the firm to configure a NAT on hardware vpn gateway to give my servers acces to a cloud service. Now servers are part of System911 domain. ...
user612579's user avatar
1 vote

Default for lmcompatibilitylevel if it doesn't exist

A response from a Microsoft employee to a similar question on Windows Server 2008 on MSDN: The default level value for LmCompatibilityLevel for each version of Windows is as follows: Windows XP: ...
tony's user avatar
  • 11
1 vote
Accepted

NTLM authentication and non-domain joined computers accessing shares on a domain

Yes, that is the case, though there are reasonable steps you can take to make NTLM authentication ...less risky. (But not risk free.) Use long passwords NTLM passwords are still digested using a ...
Adambean's user avatar
  • 154
1 vote

IIS NTLM authentication prompting for passwords on alternate DNS name

Sending creds to a web server is risky. Each browser has a policy setting or file that determines if the browser sends creds without prompt. Chrome and FF here. https://specopssoft.com/blog/...
markgamache's user avatar
1 vote

Office365 NTLM authentication

According the article you provided, it seems NTLM authentication is only available for Exchange on-premises servers.
Shaw Lu's user avatar
  • 339
1 vote
Accepted

npm install behind one proxy but got Http Error=407 (Forefront TMG requires authorization)

Finally find out the solution: don't use plain text password ( add one # at the beginning of the Password line, like change Password XXX to #Password XXX) use PassLM, PassNT, PassNTLMv2 instead (it ...
Sphinx's user avatar
  • 161
1 vote

Change Mozilla settings globally on internal network

MozillaGPO project provides mozilla autoconfig.js module that allow managing mozilla software wia Group Policy.
Slipeer's user avatar
  • 3,313
1 vote

What does AuthForwardServerList do?

I recently came across this and wanted to provide an answer, even though the question is dated. My answer comes from TechNet KB 943280. After the AuthForwardServerList registry key is created, the ...
Sam Erde's user avatar
  • 3,467
1 vote

How can I check if my IIS site is using NTLM or Kerberos?

Found out that microsoft has a really good page about Kerberos. Here are a lot of pitfalls description when you use Kerberos and Negotiation (for example on localhost the Negotiation use NTLM as ...
Flo's user avatar
  • 36
1 vote
Accepted

LmCompatibilityLevel to be applied to client, domain controller or both?

Typically the same value is configured on all Windows computers. The objective is to prevent any and all usages of NTLM1 due to the severity of the security risk. If a client transmits an NTLM1 hash ...
Greg Askew's user avatar
  • 36.7k
1 vote

How to stop NTLM v1 authentication from being accepted on a Windows VM environment?

From my experience, I've faced this because of setting ntlm.auth.domain with incorrect domain name, when configuring NTLMv2 (Configured an authentication in 2008 R2). Found the solution in @Silvio ...
Strepsils's user avatar
  • 5,115
1 vote

Force anonymous authentication to use NTLM v2 rather than NTLM v1?

I think if you look at this answered question, that you will see how to disable NTLMv1 connections and that should force the connection to be over NTLMv2
Rowan Hawkins's user avatar
1 vote

AUTH NTLM Authentication Format

What would the format be? Something like "domain/user password"? Not so simple: NTLM does not transmit passwords in an unencrypted form. Here is an example SMTP session with NTLM authentication. ...
Slipeer's user avatar
  • 3,313
1 vote

Why is only the first request to an NTLM authenticating proxy challenged and how do subsequent requests through the proxy get authenticated?

Just for more information on this. There's quite a lot of work that has to be done relating to any NTLM handshake / auth. For starters, the request is typically sent 3 times in order to complete the ...
Adrien's user avatar
  • 267
1 vote

Why is only the first request to an NTLM authenticating proxy challenged and how do subsequent requests through the proxy get authenticated?

I found the answer - WinGate proxy has an non-standard behaviour by default - it caches credentials against the IP address of the client. So once NTLM has authenticated once, all subsequent requests ...
fineman's user avatar
  • 21
1 vote

How to use nginx to proxy to a host requiring NTLM authentication?

According to nginx documentation: upstream http_backend { server 127.0.0.1:8080; ntlm; } Allows proxying requests with NTLM Authentication. The upstream connection is bound to the client ...
Gabriel Hodoroaga's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible