How do you find out if Active Directory is using Kerberos or NTLM?

Question

Is there a command line program you can use?

I don't have access to the Domain Controller, just other clients. — LeWoody, Jun 25 '09 at 20:51
Download Thunderbird mail client and enter in your login information, Thunderbird will auto-discover if Active Directory is using Kerberos or NTLM. — Eric Leschinski, Aug 04 '13 at 14:01

score 10 · Answer 1 · answered Jun 26 '09 at 18:49

I think question should be twisted on its head. Active Directory supports both Kerberos and NTLM. Windows will first try Kerberos and if all requirements are not met it will fallback to NTLM.

I will give you example, accessing file share by name like \server1\share would invoke Kerberos and should succeed given proper permision. But accessing same file share using IP address would invoke Kerberos first and fail (as there is no SPN for IP Address) and then fail over to NTLM.

So determine how your program is trying to authenticate against AD and should tell you which protocol is being used.

I would be curious to know, what prompted to ask you this question.

score 8 · Answer 2 · edited Oct 04 '13 at 12:49

8

You can view the list of active Kerberos tickets to see if there is one for the service of interest, e.g. by running klist.exe.

There's also a way to log Kerberos events if you hack the registry.

edited Oct 04 '13 at 12:49

Samuel Harmer

214
2
8

answered Jun 25 '09 at 23:00

TonyUser

428
2
4

score 2 · Answer 3 · answered Jun 26 '09 at 13:11

You should really be auditing logon events, whether the computer is a server or workstation. It's helpful to figure out which users are accessing your system, and to troubleshoot security related issues.

You can modify your Audit Policy with Group Policy: Start...Run...gpedit.msc...Computer Configuration, Windows Settings, Security Settings, Local Policies, Audit Policy, "Audit logon events". Check the "Success" and "Failure" check boxes. Try logging out and logging in to see some typical 540 events in your Windows Security Event Log.

score 0 · Answer 4 · answered Jun 25 '09 at 20:32

0

Netstat shows all listening TCP and UDP connections. using the option -na is for all connections and no resolution of names or ports. 'b' option is to show the program assiciated with it. If DNS is running it may show alot of other connections so you might want to also specify TCP.

Kerberos is most definately running if its a deploy Active Directory Domain Controller.

netstat -nab

answered Jun 25 '09 at 20:32

Jason B Shrout

394
2
9

`The requested operation requires elevation.` – Amit Naidu Jun 03 '19 at 16:56

score 0 · Answer 5 · answered Jun 25 '09 at 20:39

0

Assuming you're auditing logon events, check your security event log and look for 540 events. They will tell you whether a specific authentication was done with Kerberos or NTLM.

answered Jun 25 '09 at 20:39

Boden

4,948
12
48
70

i don't have any 540 events :( – LeWoody Jun 25 '09 at 20:54

score 0 · Answer 6 · edited Jan 03 '15 at 11:45

 public string FindAllUsers()
        {
            string strReturn="";
            try
            {
                DirectoryEntry directoryEntry = new DirectoryEntry("WinNT://" + Environment.UserDomainName);
                string userNames = "";
                string authenticationType = "";
                foreach (DirectoryEntry child in directoryEntry.Children)
                {
                    if (child.SchemaClassName == "User")
                    {
                        userNames += child.Name + Environment.NewLine; //Iterates and binds all user using a newline
                        authenticationType += child.Username + Environment.NewLine;
                    }
                }

                strReturn = userNames + "\n\n" + authenticationType;
                //Console.WriteLine("************************Users************************");
                //Console.WriteLine(userNames);
                //Console.WriteLine("*****************Authentication Type*****************");
                //Console.WriteLine(authenticationType);
            }
            catch (Exception)
            {
                Console.WriteLine("Network error occured.");
                strReturn = "";
            }
            return strReturn;
        }

This needs a lot more explanation to be useful. – Sven Jan 03 '15 at 11:46 — Sven, Jan 03 '15 at 11:46

score 0 · Answer 7 · answered Nov 26 '16 at 23:24

You can try this tool. http://blog.michelbarneveld.nl/media/p/33.aspx

This is a tool to test Authentication on websites. It will show what authentication type is used: Kerberos, NTLM, basic, none. But it also shows other information like: SPN used, HTTP headers, decrypted NTLM and Kerberos authorization headers. And it can also show and delete your Kerberos Tickets.

score -1 · Answer 8 · answered Jul 10 '09 at 21:13

Depends on the client/server that is involved. For example, there is a web page (sorry, don't have time to search for it now) you can put on a web site that will tell you if kerberos or NTLM was used. However I know of no way to tell what authentication method SQL server has used. Although as has been sugegsted before, the security log may tell you.
Why are you trying to find out?

How do you find out if Active Directory is using Kerberos or NTLM?

8 Answers8

Linked

Related