Re: Disable ALL Lan Manager Authentication
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 09/20/05
- Next message: kevin via WinServerKB.com: "Re: How to disallow name resolution for external address?"
- Previous message: Steven L Umbach: "Re: RPC Server Unavailable When Requesting Computer Certificate"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 20 Sep 2005 16:58:59 -0500
It is not possible to completely disable it. There are also cases where it
is required such as for VPN and I also believe possibly some implementations
of Exchange. You can manage lan manager authentication level to allow only
ntlmv2 which also is a pretty robust authentication protocol though again be
careful with Exchange and VPN servers. You could also configure sensitive
domain servers [not domain controllers] with an ipsec require policy which
by default would use kerberos for computer authentication before access
would be allowed and in such case it would be impossible say for a Windows
98 or non domain computer to access the ipsec required server. Ipsec is a
fairly complex topic and must be configured correctly and tested [ideally on
a test domain], particularly for domain controllers, or all sorts of
problems will ensue. The link below is a great article on ipsec even if you
just read the appendixes which will give you an excellent understanding of
ipsec and how to use it. --- Steve
http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/default.mspx
"jeff" <jeff@discussions.microsoft.com> wrote in message
news:F3C142CC-854C-4037-9C6B-DA4DFD744FFD@microsoft.com...
> Hello...
>
> I'm in a pure Windows 2003 domain environment with Windows XP clients. All
> servers and workstations are joined to the domain. We are at Windows 2003
> forest
> functional level.
>
> I know kerberos is the default authentication protocol. But...
>
> I have been asked...(if possible) to completely disable all levels of Lan
> Manager authentication capabilities from out
> environment...LM..NTLM..NTLMv2
>
> is this possible.....?
>
> Thanks
- Next message: kevin via WinServerKB.com: "Re: How to disallow name resolution for external address?"
- Previous message: Steven L Umbach: "Re: RPC Server Unavailable When Requesting Computer Certificate"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
