|
Posted by =?Utf-8?B?S2FybCBMZXZpbnNvbiBb on July 11, 2006, 10:50 am
If you were Registered and logged in, you could reply and use other advanced thread options
Kerberos. It's not either / or. Many client and server machines use both,
depending on which one is negotiated. If this didn't happen, machines joined
to Kerberos domains wouldn't be able to connect to downlevel clients, and
downlevel NT / 98 systems wouldn't be able to join domains.
Check your Group Policy and Registry settings to see the relevant NTLM /
Kerberos negotiation settings to see that this is true. Most of the settings
involve negotiating authentication protocol from a list of choices.
With Windows 2000, there was an issue where once the client connected to a
Windows 2000 domain, whether NTLM or Kerberos were used, it could no longer
connect to an NT controller. But you just needed to unjoin and rejoin the
client workstations to the domain to go back.
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info
"DeadSquirrell" wrote:
> Howdy
>
> We are in the middle of an in-place upgrade from NT4 to Windows 2003 SP1 AD.
> We are using the NT4Emulator key as a transitional step to prevent Windows XP
> SP1 clients from using Kerberos for a range of reasons. We are about to
> neutralize all machines in our upgraded domain which will mean that all
> clients will begin
> to use Kerberos once their secure channels are reset. We have chosen this
> method over simply removing NT4Emulator as it gives us a better back-out
> option (i.e. we can selectively back out machines from Keberos without having
> rejoin the whole fleet to the domain).
>
> My question is - once we remove the Emulator keys from the Domain
> Controllers and all the clients are using Kerberos, is there any way we can
> force the clients to use NTLM? The reason I ask is that we are concerned that
> Kerberos may break some of our key applications and would like to ensure that
> once the emulator is removed, we have an alternative to revert to NTLM
> without rejoining everything to the domain.
>
> Regards,
> DB
>
> [Note: This is a cross post as the topic was noted as less applicable in the
> Windows XP Security newsgroup]
>
>
| 
XML site map