Change from NTLM authentication to kerberos authentication

Question

Hello,

I am informed to remove few computers from NTLM authentication and configure Kerberos authentication.

Computers are part of a security group to use the NTLM authentication. If the group is removed from the computers, then will it use Kerberos authentication default? or how to configure the computers to use the Kerberos authentication?

Note: Here computers connect from one forest to other forest

example: abc.contoso.com and def.contoso.com

Answer 1

Hi @Boopathi S

•

Computers are part of a security group to use the NTLM authentication. If the group is removed from the computers, then will it use Kerberos authentication default? or how to configure the computers to use the Kerberos authentication?

Before disable ntlm , you should check if all your application are using only kerberos.

Enable audit to trace all NTLM authentification to identify which service still use NTLM not Kerberos.

Right now there are some windows service still using ntlm by default and not kerberos.

If you want test the impact of disabling NTLM in your envirement to avoid any generale issue you can create GPO and apply it on only specific group where you will ad test machine to disable NTLM.

I invite you to read this article talking about how disable NTLM:

How to Disable NTLM Authentication in Windows Domain

---

Please don't forget to accept helpful answer

---