Prepare for NTLM disable in your domain environment

Microsoft has made an announcement stating that the NTLM authentication protocol will be disabled in Windows 11. Instead, it will be replaced by Kerberos, which is currently the default authentication protocol in Windows versions above Windows 2000.

 

https://petri.com/microsoft-disable-ntlm-windows-11/

 

To prepare for this change is coming, you can enable a GPO to audit what application is using NTLM I n your environment and also what version of NTLM still using?

 

 

https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/audit-domain-controller-ntlmv1

https://superuser.com/questions/1694421/how-can-i-find-out-what-is-using-ntlm-in-my-environment

https://mahim-firoj.medium.com/how-to-check-what-ntlm-version-you-are-using-in-your-domain-9eb4aed9f317

https://4sysops.com/archives/auditing-and-restricting-ntlm-authentication-using-group-policy/

 

Prepare for NTLM disable in your domain environment

Windows 10 Version 1607 (Anniversary update) - change default logon domain name in the logon screen

Problem Statement:
We found that the Windows 7 and Windows 10 (1607) have different behavior of the GPO -  Interactive logon: Do not display last user name - Enabled

Both machine domain is different from user machine, Windows 10 under abc.com (abc) and Windows 7 under def.com (def)

And the user is under nmo.com (nmo) domain.

After the first time logon, the Windows 7 able to "remember" the user domain (nmo) as the default logon domain for user, but Windows 10 cannot (It keeps abc - the machine domain).

Workaround solution:
We found that we need to add the following registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"DefaultLogonDomain"="nmo"

Remark:

The problem being fixed on 1703 (15063.608) (This patch level which is I test, maybe it already fixed on early than this patch level on 1703)
What we need to do is enter your domain name (e.g. mno\username) first time login, after that your able to login without enter your domain name again. (Same behavior of Windows 7)

Reference:
https://social.technet.microsoft.com/Forums/windows/en-US/de5fea8e-e327-4d71-a599-546dea543149/change-default-logon-domain-name-in-the-logon-screen?forum=w7itpronetworking

Windows 10 Version 1607 (Anniversary update) - change default logon domain name in the logon screen

All non-domain user and computer to access file share on domain member server

1.    Enable the "Guest" account on that domain member server which is hosting and sharing those files and folder (e.g. File Server)

2.    then grant the "Everyone" group on the share folder “security” permission (NTFS permission) and share permissions

“Security” Permission (NTFS Permission)

Share Permissions:

Reference:

http://serverfault.com/questions/51635/how-can-an-unauthenticated-user-access-a-windows-share

All non-domain user and computer to access file share on domain member server

Event ID 40960 + 40961 / SPNEGO

Event ID 40960 + 40961 / SPNEGO

Cannot use domain account to login a Windows XP machine.

Event ID 40960 + 40961 / SPNEGO

1. checked the Network Settings, looking for DNS entries (nslookup -q),
2. checked Network speed,
3. flushed DNS Chache (ipconfig /flushdns), - ipconfig /displaydns to check the result
4. registered new entrie on DNS Server (ipconfig /registerdns),
5. do netdom reset (netdom reset COMPUTERNAME /Domain:DOMAINNAME.net) - Resets the secure connection between a workstation and a domain controller.

If still not able to solve the problem, re-join domain.

Event ID 40960 + 40961 / SPNEGO