I went to my first IT conference in April 2004 \u2013 it was WinConnections in Vegas. It was there I heard people like Mark Minasi, Steve Riley, and Jeremy Moskowitz speaking for the first time. It was there that I started thinking beyond the off-the-shelf text book and training course. One of the things that came up was authentication security. Active Directory could use NTLM, NTLMv2, or Kerberos, with the latter being the most secure, and the former being not so good (I think they put it in stronger terms).<\/p>\n
The advice was to disable NTLM authentication across the network using GPO. I\u2019ve heard it dozens of times since. It seems to be accepted best practice. I\u2019ve seen it deployed countless times.<\/p>\n
We Hyper-V engineers\/administrators are going to have a problem with that. Cluster Shared Volume (CSV, the Windows Server 2008 R2 shared file system for clustered Hyper-V hosts) uses NTLM authentication between the hosts<\/a>. Enabling a policy to disable NTLM will break CSV and cause the following alert:<\/p>\n This is another situation where security auditors will try to enforce policy that will break things for us (the other is antivirus on the host). You will need an exception to this policy for all clustered Hyper-V computer objects. You can do this by using a security group to filter the offending policy in question. That will require a single GPO to apply this one setting. Alternatively you can create and link another GPO that applies just to the clustered hosts. This GPO will enable NTLM.<\/p>\n I went to my first IT conference in April 2004 \u2013 it was WinConnections in Vegas. It was there I heard people like Mark Minasi, Steve Riley, and Jeremy Moskowitz speaking for the first time. It was there that I started thinking beyond the off-the-shelf text book and training course. One of the things that … Continue reading “Windows Server 2008 R2 Hyper-V CSV and NTLM”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[20],"tags":[63,181,195,117],"class_list":["post-10842","post","type-post","status-publish","format-standard","hentry","category-hyper-v","tag-failover-clustering","tag-hyper-v","tag-virtualisation","tag-windows-server-2008-r2"],"aioseo_notices":[],"jetpack_featured_media_url":"","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/10842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10842"}],"version-history":[{"count":0,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/10842\/revisions"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n