Re: why are some connections kerberos and others ntlm?



Hello

That's 'negotiate' request from client. On 'negotiate' request, server first
check if kerberos, most safe, is available. If not, it falls back to NTLM.
Sometimes, for example .Net network credential, you can set the client
request options such as kerberos, NTML, and negotiate. With the first two
request, server doesn't negotiate.

"WalterWalt" <,> wrote in message
news:uPFyJ%23eJHHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
I am looking at the sys.dm_exec_connections view and notice some
connections are Kerberos and others NTLM. All the users are on XP SP2.

It seems the kerberos connections are getting the "Cannot generate SSPI
context" every day or so, would this be the case/

Thanks



.



Relevant Pages

  • v6 windows Update Error 0x80072EEF
    ... The WinXP and Win2003 server machines update progerly using the same isa ... <Negotiate (NTLM or Kerberos);> ...
    (microsoft.public.windowsupdate)
  • Re: WebClient + Credentials + HTTP 401 Status Codes
    ... It is the Negotiate protocol, meaning that it will try to user Kerberos ... first and will fail over to NTLM if Kerberos can't be negotiated. ... > The WebRequest object has PreAuthenticate, not WebClient. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: IIS 6.0 Windows Authentication 401 Every Request
    ... After reading a lot of articles, I was finally able to get Kerberos and NTLM ... every request to a page, it'll throw a 401, and then the next request ... authentication, and have that work for the rest of the session. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Each HTTP object being requested twice (401 then 200 responses)
    ... Authentication" and the web.config authentication setting is ... Authorized because the request was made anonymously. ... requests the same object a second time it uses kerberos; ... Kerberos and not NTLM, which is good since that's a requirement for ...
    (microsoft.public.inetserver.iis.security)
  • Each HTTP object being requested twice (401 then 200 responses)
    ... Authentication" and the web.config authentication setting is ... Authorized because the request was made anonymously. ... requests the same object a second time it uses kerberos; ... Kerberos and not NTLM, which is good since that's a requirement for ...
    (microsoft.public.inetserver.iis.security)