Thanks, though currently we are not using NTLMv2 authentication for RPC
applications (LMCompatibilty is set to Send LM & NTLM). I'm still
finding this is a hit and miss to get Integrated Auth to work properly
with clients. One client changed from DHCP which Integrated Auth worked
fine, to a static IP and it no longer worked (even after removing DNS
entries from the domain and forcing a registerdns). All other settings
look fine as to what was previously posted.
The question would be, why does it work for some but not others? That
is what I'm not understanding at this point.
Thanks,
Trevor
-----Original Message-----
From: nobody@nobody.com [mailto:nobody@nobody.com]
Sent: Wednesday, June 15, 2005 3:53 AM
To: focus-ms@securityfocus.com
Subject: Re: Kerberos & NTLM Auth in IIS6
A little known fact regarding NTLMv2 is that only those applications
that authenticate using the Local Security Authority (LSA) will be
affected by the LMCompatibility mode setting. That includes file sharing
and domain logons. A number of applications use the NTLM Security
Support Provider Interface (NTLMSSP) to authenticate, and there is a
separate setting to enable
NTLMv2 for them. Examples of such applications include SQL Server (when
using RPC) and many other (secure) RPC-based applications. NTLMv2 for
NTLMSSP has to be enabled on a given machine, both for the machine's
functionality as a server and as a client. The registry has to be edited
to enable NTLMv2 for RPC .
Edit the registry and set the appropriate keys. These keys do not exist
by default or are set to 0.
To set NTLMv2 Security on the server side add the following registry key
To set NTLMv2 Security on the client (Windows 9x/NT/2000/XP) side add
the following registry
key:
Enable NTLMv2 Authentication for NTLM Security Support Provider
Interface (NTLMSSP) mandatory Hive HKEY_LOCAL_MACHINE Key
\System\CurrentControlSet\Control\Lsa\MSV1_0\
Value
Name
NtlmMinServerSec
Type REG_DWORD
Value 0x00080000
Hive HKEY_LOCAL_MACHINE
Key \System\CurrentControlSet\Control\Lsa\MSV1_0\
Value
Name
NtlmMinClientSec
Explanation
Measure
Implementation
NOTE:
Both, the client and server side has to be set to work properly.
When the
"HKLM\System\CurrentControlSet\control\LSA\LMCompatibilityLevel" does
not enable a machine to negotiate NTLMv2 authentication, then this
setting will make certain remote features fail (e.g. mapping of shares).
So the LMCompatibilityLevel must be set to allow
NTLMv2 authentication at the same time.
We were made aware that in cluster solutions the LMCompatibilityLevel
must be set to "Send LM and NTLM responses only" (see also:
<http://support.microsoft.com/default.aspx?scid=kb;ENUS;
q272129> ) and that the registry settings above must not be made at all!
You can find more information about s-RPC at:
<http://support.microsoft.com/default.aspx?scid=kb;EN-US;q239869>
and
<http://support.microsoft.com/default.aspx?scid=kb;EN-US;q147706>
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
