3 ms·
It's in the article: (and the whole reason for finally killing off NTLM) > However, Microsoft is now working on two new Kerberos features: IAKerb (Initial and
by smileybarry 3y ago
It's in the article: (and the whole reason for finally killing off NTLM)
> However, Microsoft is now working on two new Kerberos features: IAKerb (Initial and Pass Through Authentication Using Kerberos) and Local KDC (Local Key Distribution Center).
> "The local KDC for Kerberos is built on top of the local machine's Security Account Manager so remote authentication of local user accounts can be done using Kerberos," Microsoft's Matthew Palko explained.
> "This leverages IAKerb to allow Windows to pass Kerberos messages between remote local machines without having to add support for other enterprise services like DNS, netlogon, or DCLocator. IAKerb also does not require us to open new ports on the remote machine to accept Kerberos messages."
- projektfu 3y agoThanks, I skimmed. I wonder if there are other ad-hoc Kerberos systems like this.
- smileybarry 3y agoAFAIK there aren't, and that's the reason for that huge chasm between proper Kerberos and NTLM. I think the old Windows 7-era Home Group was somewhat of a mashup between the two with account syncing, but might've been on top of NTLM anyway.