Terminal Server 2008 NTLMV2 issues!

[darknova]

Hey All,

 

Just polishing off my Terminal Server 2008 setup and have left this issue to last...

 

I'm trying to get my clients to use NTLMV2 to authenticate, however they seem to be only authenticating to the Gateway using NTLMV1...

 

I have setup the computer I'm using to test the RDP connection to use Security Policy: Send NTLMv2 response only/refuse LM and NTLM

 

However it seems to be only Authenticating Using NTLM... so I went onto the Terminal Server and setup a Network Policy Constraint to use Authentication Methods of (MS-CHAP-V2) rather then Allow Clients to connect without negotiating an authentication method.

 

However when I do this I get the following error:

 

The user "domain\testuser", on client computer "10.1.1.40", did not meet connection authorization policy requirements and was therefore not authorized to access the TS Gateway server. The following authentication method was attempted: "NTLM". The following error occurred: "23003".

 

Currently a user will go to the gateway, which will then authorise the user to access the terminal server. The gateway checks the users details using a radius server, then the network policy is applied... and then the user is logged on… (At the moment only using NTLMV1 )

 

Any Ideas…?

 

DK

[Geoff]

To 'require' NTLMv2 means you must also 'require' 128-bit encyption. If you do not do both of these, than NTLM will be negotiated instead.

[darknova]

To 'require' NTLMv2 means you must also 'require' 128-bit encyption. If you do not do both of these, than NTLM will be negotiated instead.

 

Here comes the noob question....

 

Any ideas where I would specify this on the Gateway Policy? I have specified the 128bit Encryption on the network policy... but this negotiates the use of NTLMV1 not V2.

 

I suspect that I am authenticating to the gateway using NTLM... which is causing the issue... but I can't see where I can specify which sort of connection to negotiate using NTLMV2.

[Geoff]

I believe you must enforce it in the connection authorization policy.