55
votes
RDP error "The function requested is not supported" after enabling NLA
I had the same issue. I found the issue has to do with a Windows Update patch that was pushed out to my work station in last nights Windows Updates. There was a critical CVE (CVE-2018-0886) for RDP ...
- 661
7
votes
Hardening a file-serving Windows Server 2019 instance
First of all, reinstall the server, because :
This one might be compromised and can't be trusted anymore.
Windows is secure by default, and maybe someone lowered the security settings of your server, ...
- 6,635
6
votes
Accepted
Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
Greg's answer is alright, but your question specifically states that you want to check this from the client, not from the domain controller. So I'll take a crack at it.
First way, enable Kerberos ...
- 55.3k
5
votes
How can I check if my IIS site is using NTLM or Kerberos?
If you have access to your IIS server then the answer is much simpler than inspecting HTTP traffic: Simply view the site Authentication module config for Windows Authentication.
In IIS Manager
...
- 2,584
5
votes
Office365 NTLM authentication
No, you cannot. O365 uses modern claims based auth, so WS* and SAML. Possibly OAUTH or OPENID too.
If you have on-prem AD, ADFS, you can probably auth to that, and get a token to pass to O365.
- 195
5
votes
Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)
One way would be to check the domain controller Security event log for Event ID 4624 (logon) events, where the AuthenticationPackageName is NTLM or Kerberos. You should also verify that your Domain ...
- 35.3k
3
votes
FreeRADIUS using Active Directory integration broken without any traces
Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and ...
- 137
3
votes
Accepted
Improving Windows Authentication performance on IIS
The issue was quite difficult to figure out. After doing investigations for quite some time we found that it was sporadic and not always present.
We used nltest /dclist:<domain_name> to get a ...
- 200
2
votes
Accepted
Authenticate NTLM at reverse proxy in front of unauthenticated web servers
I ended up with 2 viable solutions to this problem. Hopefully this will be helpful to anyone trying to setup something similar.
Set up IIS with ARR (Application Request Routing) and enable Windows ...
- 101
2
votes
Accepted
Looking for a lightweight NTLM HTTP proxy server
Just stumbling upon your question. We too had to test against a NTLMv2 capable http proxy (from Java).
In the end, we used a product called WinGate, which is free up to some users. We just installed ...
- 136
2
votes
Accepted
How do you enable ntlm v3 on windows server 2008 on IIS?
I do NTLM stuff all day and I can assure you,there is is no such thing as NTLMv3. Depending on your boss, you can mock her/him, or ask for more details and see what happens. Ask why. :-P
Maybe he/...
- 195
2
votes
Vagrant behind NTLM proxy on windows - guest unable to connect to the host proxy
I also tried the links you did with no luck, then I came across: Using vagrant with cntlm proxy. The mistake we both made was to use the HOST only network (e.g. 192.168.33.*) We want to access the ...
2
votes
RDP error "The function requested is not supported" after enabling NLA
I had the same issue with a remote VM, with only RDP access. This worked for me...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters]
"...
- 21
2
votes
RDP error "The function requested is not supported" after enabling NLA
See
Windows RDP: ‘An authentication error has occurred’
This is happening after you have a applied a windows security update it was this security update. It also tells you how to change your GPOs ...
- 21
2
votes
IIS and HttpListener (.NET) with windows authentication
I have an explanation for this, you are attempting to achieve Single Sign On (SSO) using the negotiate / integrated windows authentication mechanism. This will not work with the Local Security ...
- 61
2
votes
NTLM authentication module mod_auth_ntlm_winbind for Apache2 omits domain name
Ok, I've found a solution. The deal is configuration of mod_auth_ntlm_winbind's underlying mechanism, winbind. It is a part of Samba and uses it's config file. In my cases there was option "winbind ...
- 31
1
vote
Accepted
npm install behind one proxy but got Http Error=407 (Forefront TMG requires authorization)
Finally find out the solution:
don't use plain text password ( add one # at the beginning of the Password line, like change Password XXX to #Password XXX)
use PassLM, PassNT, PassNTLMv2 instead (it ...
- 141
1
vote
Change Mozilla settings globally on internal network
MozillaGPO project provides mozilla autoconfig.js module that allow managing mozilla software wia Group Policy.
- 3,295
1
vote
Accepted
LmCompatibilityLevel to be applied to client, domain controller or both?
Typically the same value is configured on all Windows computers. The objective is to prevent any and all usages of NTLM1 due to the severity of the security risk. If a client transmits an NTLM1 hash ...
- 35.3k
1
vote
How to stop NTLM v1 authentication from being accepted on a Windows VM environment?
From my experience, I've faced this because of setting ntlm.auth.domain with incorrect domain name, when configuring NTLMv2 (Configured an authentication in 2008 R2).
Found the solution in @Silvio ...
- 4,907
1
vote
Force anonymous authentication to use NTLM v2 rather than NTLM v1?
I think if you look at this answered question, that you will see how to disable NTLMv1 connections and that should force the connection to be over NTLMv2
- 610
1
vote
AUTH NTLM Authentication Format
What would the format be? Something like "domain/user password"?
Not so simple: NTLM does not transmit passwords in an unencrypted form. Here is an example SMTP session with NTLM authentication.
...
- 3,295
1
vote
Why is only the first request to an NTLM authenticating proxy challenged and how do subsequent requests through the proxy get authenticated?
Just for more information on this. There's quite a lot of work that has to be done relating to any NTLM handshake / auth. For starters, the request is typically sent 3 times in order to complete the ...
- 267
1
vote
Why is only the first request to an NTLM authenticating proxy challenged and how do subsequent requests through the proxy get authenticated?
I found the answer - WinGate proxy has an non-standard behaviour by default - it caches credentials against the IP address of the client. So once NTLM has authenticated once, all subsequent requests ...
- 21
1
vote
How to use nginx to proxy to a host requiring NTLM authentication?
According to nginx documentation:
upstream http_backend {
server 127.0.0.1:8080;
ntlm;
}
Allows proxying requests with NTLM Authentication. The upstream connection is bound to the client ...
1
vote
Accepted
How to use nginx to proxy to a host requiring NTLM authentication?
The Nginx customer service confirmied that nginx currently does not authenticate ntlm, only proxy that authentication to the upstream server with NGINX Plus
- 11
1
vote
Accepted
Determine usage of UPN for logon inside MS AD forest / domain
Ok I can now, after the testlab, answer this myself.
The initial request for a TGT from the system being logged into to the domain controller contains the username in clear text in the kerberos ...
1
vote
NTLM on a Load Balanced Environment
The "AuthPersistSingleRequest" setting default value is False, which means if set to the default you should not see persistent authentication challenges on subsequent requests to the same server. If ...
- 35.3k
1
vote
Why Squid ntlm_auth works only when "cache_effective_group root"
I have found an answer by myself:
The real place for Winbind privileged pipe is /var/lib/samba/winbindd_privileged (NOT /var/run/samba/winbind_privileged)
In Jessie it owned by root:root and has ...
- 41
1
vote
Accepted
RDP client error - An authentication error has occured (0x609)
The error was in this step:
The proxy receives and modifies (if necessary) the ConnectionRequestPDU message of the RDP Protocol to ensure the SupportedProtocol flags are set to ProtocolHybrid &...
Only top scored, non community-wiki answers of a minimum length are eligible