Use of Kerberos unreliable, can I force it?

[NoelByron@gmx.net]

Hi!

I had to learn that it is easily possible for clients in our network
to work without Kerberos (tickets). Mostly because they boot their
computer without a network connection. Those users have no Kerberos
tickets (of course) but they don’t get Kerberos tickets even after
connection to our network (bug or feature?). There are also some other
scenarios in which Windows relinquishes Kerberos. The problem is that
we have some web applications that require a Kerberos ticket.

My question: How can I switch on Kerberos as soon as they connect to
the network? Or how can I force Kerberos authentication in a web
application (SharePoint). Integrated Windows Authentication means NTLM
or Kerberos…

Tips would be highly appreciated. Thanks in advance!

Best regards,
Noel

 

[S. Pidgorny]

You can't. We have been asking this of Microsoft for quite a while now.

As to the users not getting tickets after connecting to the network, that is
a problem. Maybe related to your configuration but also can be caused by a
bug - there are quite a few KB articles and hotfixes for Kerberos.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

<NoelByron@gmx.net> wrote in message
news:9df4479f-db82-45ab-9eed-4c81f7b6ea4b@56g2000hsm.googlegroups.com...
Hi!

I had to learn that it is easily possible for clients in our network
to work without Kerberos (tickets). Mostly because they boot their
computer without a network connection. Those users have no Kerberos
tickets (of course) but they don’t get Kerberos tickets even after
connection to our network (bug or feature?). There are also some other
scenarios in which Windows relinquishes Kerberos. The problem is that
we have some web applications that require a Kerberos ticket.

My question: How can I switch on Kerberos as soon as they connect to
the network? Or how can I force Kerberos authentication in a web
application (SharePoint). Integrated Windows Authentication means NTLM
or Kerberos…

Tips would be highly appreciated. Thanks in advance!

Best regards,
Noel