Tag: NTLM

If the Network Device Enrollment Service (NDES) is newly installed (preferably without Enterprise Administrator permissions ), only the Windows-integrated authentication for the administration web page is activated at first. With this (via NT LAN Manager, NTLM) protocol, authentication via user name and password is also possible. However, not all client applications support this.

Likewise, a company might want to disable NTLM where possible and enforce Kerberos for logon . Enforcing Kerberos removes the ability to log on to the Network Device Enrollment Service administration page via username and password (since this is done with NTLM credentials). However, Basic Authentication can be retrofitted to provide an option here again.

One way out of this dilemma can be Basic Authentication, the setup of which will be explained below.

Continue reading "Enabling Basic Authentication for the Network Device Enrollment Service (NDES)"

Many companies pursue the strategy of (largely) disabling the NT LAN Manager (NTLM) authentication protocol in their networks.

This is also possible for the administration web page of the Network Device Enrollment Service (NDES). How exactly this is implemented and how this may change the application behavior is explained below.

Continue reading "Disabling NTLM and enforcing Kerberos at the Network Device Enrollment Service (NDES) administration web page"

Assume the following scenario:

• You want to establish a remote desktop connection.
• The client computer from which the connection is made is not a member of the same Active Directory forest as the target computer.
• The connection fails with the following error message:

A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support.

Continue reading "No remote desktop logon possible from outside the Active Directory forest"