Re: Disable Kerberos in a Windows Server 2003 Environment

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Thanks Joe! I will investigate this further and try to determine if there is
a specific service that they are running for single-signon. If this ends up
going any further, I will re-post. Thanks again for all of your help, it is
very much appreciated.

Thanks
Gerry

"Joe Kaplan" wrote:

Without more details on what he's doing and what he really needs, I can't
give you a satisfying answer. It is definitely possible to prevent Kerberos
authentication to a given service by making sure the service principal name
(SPN) for the service is not published in the directory. If no SPN exists
for a given service, Kerberos auth to it is not possible.

However, we don't know enough about what is going on here to know if that
might be a viable option.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"JerryAMWE" <JerryAMWE@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:21F92E8D-9D75-4996-A830-38EFCD9D52F8@xxxxxxxxxxxxxxxx
I'm not sure why our HIS system requires NTLM for single-signon
authentication. You have raised an interesting question though; can I
specify his servers/app to use NTLM and leave the rest of my environment
alone? If so, how?

Thanks
Gerry

"Joe Kaplan" wrote:

Do you have any detailed information about why his product requires NTLM
only? Is it possible that this product will work if it does NTLM auth to
just those specific apps, but still uses Kerberos in general?

I'm not even sure if it is possible, but ou really don't want to try to
get
rid of Kerb across the board.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"JerryAMWE" <JerryAMWE@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7439B34C-0BAB-4FA0-816D-44DB88B14210@xxxxxxxxxxxxxxxx
Hi,

We are a hospital running a Microsoft Server 2003 environment with
Microsoft Exchange, Citrix and a few other vendor applications that
integrate
with Active Directory for authentication. We are at the highest
possible
functional level in our environment. We also have a Hospital
Information
System which is the most important system we have. Our systems
engineer
wants to try to get our HIS system to use it's native single-signon
capability to authenticate users to AD. The problem is that he wants
me
to
disable Kerberos and only use NTLM authentication. My questions are:

1. Can I disable Kerberos even though my functional level is at its
highest
level?
2. If so, how do I do this?
3. Are there any consequences by me doing this? (i.e. Exchange
authentication issues, Citrix authentication issues, time-services, DNS
issues, etc....)

Any help/advice would greatly be appreciated.

Thanks,
Gerry







.

Relevant Pages

  • Re: LDAP Auth Problem - COM interop
    ... The requested authentication method is not ... Exception Details: System.Exception: Error authenticating user. ... String username, String pwd) in ... "Joe Kaplan" wrote: ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ADAM Authentication
    ... Only using ADAM for testing a proof-of-concept; ... "Joe Kaplan" wrote: ... Note that using S.DS for authentication may cause you scalability problems ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to bypass Forms Authentication on selected pages programma
    ... Hey Joe, ... "Joe Kaplan" wrote: ... authentication but before authorization) check the Url of the Request to see ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.security)
  • Re: tcp-wrappers and sshd
    ... joe> hostname) when dialing in. ... My point was that hostbased authentication ... Host keys are used by the client for server authentication, ... SSH sets up SSH protocol connections. ...
    (comp.security.ssh)
  • RE: SPS 2003 on W2k3 Standard logon problems.
    ... Joe ... >> All users are logging into the same domain that the portals are in. ... >> Windows Integrated Authentication and Basic Authentication turned on for each ... A global security group contains all my users, ...
    (microsoft.public.sharepoint.portalserver)