Replay: NTLM and Pass-Through Authentication

INTRODUCTION

Windows Server 2008 R2 and Windows 7 restricts NTLM authentication usage out of the box. This feature is known as NTLM blocking. NTLM blocking prevents NTLM from being used for authentication. IT works in both for incoming and outgoing connections, and allows you to create exceptions. NTLM Blocking is implemented using Group Policies that can be accessed under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options. These settings are

Using a combination of these policies it is possible to control and audit the flow of NTLM traffic to and from computers running Windows Server 2008 R2/Windows 7 and other computers that may be within or outside the domain.

THE POLICIES EXPLAINED

PASS-THROUGH AUTHENTICATION

The NetLogon service is responsible for implementing pass-through authentication. To perform pass-through authentication the service

• Selects the domain to pass the authentication request to.
• Selects the server within the domain.
• Passes the authentication request through to the selected server.

Selecting the domain is straightforward. The domain name is passed to LsaLogonUser. LsaLogonUser supports interactive logons, service logons, and network logons. Since the domain name specified is not trusted by the domain, the authentication request is processed on the computer being connected to as if the domain name specified were that domain name. NetLogon does not differentiate between a nonexistent domain, an untrusted domain, and an incorrectly typed domain name.

POLICY SETTINGS TO ENABLE NTLM PASS-THROUGH AUTHENTICATION

If pass-through authentication on a Windows Server 2008 R2 machine fails, then check for the presence of Network Security: Restrict NTLM: policy settings under the aforementioned policy location. To disable restrictions on NTLM authentication

1. Run command prompt as administrator.
2. At the command prompt type gpedit.msc and press enter.
3. In the local policy window, navigate to Local Computer Policy → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options and set the following policies

 

Policy	Purpose	Security Settings
Network security: Restrict NTLM: Incoming NTLM traffic	This policy setting allows you to deny or allow incoming NTLM traffic.	Allow all
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers	This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server.	Allow all
Network security: Restrict NTLM: Audit NTLM authentication in this domain	This policy setting allows you to audit NTLM authentication in a domain from this domain controller.	Enable all
Network security: Restrict NTLM: Audit Incoming NTLM Traffic	This policy setting allows you to audit incoming NTLM traffic.	Enable auditing for all accounts

 

4. Close the policy window and type, gpupdate /force
5. Close command prompt.