Windows sign-in for AI tools: Kerberos, and NTLM for older PCs

Acutis Gate · guides for IT directors · updated October 2026

Short answer: register an HTTP/ service principal name for the gateway's DNS name on the account it runs as, allow that name in the browsers by Group Policy, and serve it over HTTPS. Domain PCs then sign in with no login page. For PCs or apps that can't do Kerberos, allow NTLMv2 only, with relay protection, and log who still uses it.

Step 1: the service name

Browsers ask a domain controller for a ticket to HTTP/<the name in the address bar>. That name must exist on exactly one account: the one the gateway runs as (a group Managed Service Account is best, AD rotates its password).

1. In Active Directory Users and Computers, turn on View → Advanced Features.
2. Open the gateway's account (a gMSA lives under Managed Service Accounts) → Properties → Attribute Editor.
3. Edit servicePrincipalName and add HTTP/gate.corp.example and HTTP/gate.

Command line

# Who holds the name today? (it must be one account, or none)
setspn -Q HTTP/gate.corp.example

# Register it (and the short name) on the gateway's account
setspn -S HTTP/gate.corp.example CORP\acutisgate$
setspn -S HTTP/gate CORP\acutisgate$

Step 2: let the browsers use it

Edge and Chrome only send Windows credentials to sites on their allow list:

1. In Group Policy Management, create or edit a policy linked to the computers' OU.
2. Computer Configuration → Policies → Administrative Templates → Microsoft Edge → HTTP authentication → Configure list of allowed authentication servers: Enabled, gate.corp.example.
3. For Chrome: Google → Google Chrome → HTTP authentication → Authentication server allowlist, the same name. (Needs the Edge and Chrome policy templates installed.)

The policy name underneath is AuthServerAllowlist for both. Firefox uses network.negotiate-auth.trusted-uris.

Step 3: test it

On a domain PC, open https://gate.corp.example in Edge. You should go straight in with no password prompt. In the Gate console, Identity → Test this browser shows whether the sign-in used Kerberos or NTLM.

Command line

# On a domain PC: can it get a ticket for the gateway?
klist get HTTP/gate.corp.example
klist          # look for HTTP/gate.corp.example in the list

# From Linux, with a Kerberos ticket
kinit msmith@CORP.EXAMPLE
curl --negotiate -u : -i https://gate.corp.example/api/v1/auth/negotiate

If klist get fails with "server not found in Kerberos database", the SPN is missing or on the wrong account. A ticket that works but a browser that still prompts usually means the allow list hasn't reached that PC yet (gpupdate /force).

NTLM, done safely

Some PCs and older apps can only do NTLM. If you must allow it:

• accept NTLMv2 only, never v1 or LM,
• require relay protection (channel binding to the HTTPS certificate),
• have a domain controller check every answer,
• and log each NTLM sign-in so you can see who still needs it.

How Acutis Gate does it

Acutis Gate's on-prem installers do steps 1 and 2 for you. The Windows Server installer creates the gMSA, registers HTTP/ for the Gate name, gets a certificate from your company CA and creates the "Acutis Gate sign-in" Group Policy for Edge and Chrome. NTLM is off unless an admin turns it on, and then it follows the four rules above. People sign in to the console with no login page, and their AI client uses a personal token that is them. Everything else (rules, approvals, audit) is the same as the hosted edition.

Frequently asked questions