Skip to content

NTLM for older PCs and apps

Kerberos covers almost everyone. NTLM is for what cannot do Kerberos: PCs that open Gate by IP address, machines outside the domain that still have domain accounts, and older apps. It is off by default. Turn it on only when you have a reason.

What Gate enforces

  • NTLMv2 only. NTLMv1 and anonymous answers are refused.
  • Relay protection (Extended Protection), on unless you turn it off: the sign-in must be bound to Gate's own certificate, so a sign-in captured elsewhere cannot be replayed to Gate.
  • Single use. Each challenge is answered once, within two minutes.
  • Every NTLM sign-in is marked in the audit trail, so you can see who still needs it.

Turn it on

  1. Identity → Active Directory: tick Allow NTLM (older PCs and apps). Keep Require relay protection ticked.
  2. Press Connect (on Linux and Mac, with gate-svc's password filled in).

What happens next depends on the edition:

  • Windows Server: Gate asks the domain through the server's own trust. Nothing else to do.
  • Linux and Mac: Gate joins the domain as a computer account, the way Squid and FreeRADIUS do, and only ever asks the DC whether an answer is right. That computer account can read and change nothing. gate-svc creates it, which ordinary users may do up to 10 times by default; if your domain blocks that (ms-DS-MachineAccountQuota = 0), pre-create the computer account or let gate-svc create computers in one OU.

Check it

Health check → Run all checks: the NTLM row should be OK. Test this browser on a PC that uses NTLM shows "NTLM".

When it does not work

Health check says Fix
Windows: the server's trust with the domain is broken On the Gate server, as admin: Test-ComputerSecureChannel -Repair -Credential CORP\admin
Linux/Mac: winbind not running / the join needs renewing Identity → Active Directory, enter gate-svc's password, Connect: Gate joins again.
Relay protection cannot read the certificate The certificate Gate checks must be the one browsers see. Re-run the installer (it sets this), or with your own certificate pass --cert/--key.
On, with relay protection off Works, but less safe. Turn it back on unless an app truly cannot cope.

More: NTLM help page.