Azure MFA extension for NPS not working after disabling NTLMv1

Question

Hello Chaps,

Yesterday we disabled NTLM 1 at the Domain level and we noticed this morning the Azure MFA plugin installed on NPS server stopped working. Tried uninstalling the plugin and install the latest version from Microsoft but that didn't help. The error message on NPS logs was "An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request". We had to re-enable NTLM v1 to get the MFA working. Is there a way to force the plugin to use NTLM v2 or Kerberos for authentication? Operating system is Windows 2012 R2.

Thanks,
Kiran

Answer 1

@Oddiraju, Kiran Apologies for the delay in responding to this post. Let me do a repro this scenario in my lab.

Please help me with OS details on the server/client logs at the time of issue to investigate further.

Answer 2

We have the same issue, but on a new install.

Server 2022, nps with latest NPS azure plugin. Our AD is not supporting NTLM V1 (V1 disabled), and we get the same error "An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request".

The error comes when users is connecting and trying to get validated through a vpn client.

Following this thread to see if any solution comes up.

Answer 3

@Oddiraju, Kiran Just wanted to check whether primary authentication is working or not.

Determine if Primary Authentication is working:
Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
Restart the Network Policy Service (IAS) service for the changes to take effect
Determine if primary authentication for VPN is successful.

Let me know the results for this scenario.

Answer 4

@Tommy H Just wanted to check whether primary authentication is working or not.

Determine if Primary Authentication is working:
Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
Restart the Network Policy Service (IAS) service for the changes to take effect
Determine if primary authentication for VPN is successful.

Let me know the results for this scenario.

Answer 5

If I delete the registry entries:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters

AuthorizationDLLs

ExtensionDLLs

I can get the NPS service to start.

However they are required to do Azure MFA, and when I put them back I can't get the NPS service running again.