3 ms·
Probably one side of equation is that NTLM just works. For kerberos, you mostly have additional effort to manually add SPN. Moreover for load balanced Exchange,
by jve 8y ago
Probably one side of equation is that NTLM just works. For kerberos, you mostly have additional effort to manually add SPN. Moreover for load balanced Exchange, you must deal with alternate service account: https://docs.microsoft.com/en-us/exchange/architecture/client-access/kerberos-auth-for-load-balanced-client-access?view=exchserver-2019 https://docs.microsoft.com/en-us/exchange/architecture/clien...
- jve 8y agoMoreover (didn't have time to read yet) seems that there is just today public disclosure which highlights some issues with Kerberos: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html Don't get me wrong - thats not a case where someone should choose NTLM over more secure Kerberos. Just that we should note Kerberos should be configured appropriately.