(8) W2K8 R2 AD Upgrade Tip: NTLM Changes

In Windows 7 and Windows Server 2008 R2, NTLM-based minimum session security policy is set to require a minimum of 128-bit encryption for both client computers and servers for new installations of Windows. This requires that all network devices and operating systems using NTLM support 128-bit encryption.

DC Security: Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security Options

Network security: Minimum session security for NTLM SSP based (including secure RPC) clients

clear the

Require 128-bit encryption policy setting

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

clear the

Require 128-bit encryption policy setting

when connecting to computers running versions of Windows earlier than Windows Vista or Windows Server 2008, services running as Local System and using SPNEGO (Negotiate) that revert to NTLM use the computer identity. In Windows 7, if you are connecting to a computer running Windows Server 2008 or Windows Vista, then a system service uses either the computer identity or a NULL session. When connecting with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. When connecting with the computer identity, both signing and encryption is supported in order to provide data protection.