Root DFS and ntlm hardening

Question

Hi all&nbsp;Recently we have tried to harden our NTLM. After applying some settings the access to the root of our domain has become intermittent \domain.co.uk but all the namespaces as well as symbol etc I der the root are working fine and can be navigated to without an issue.&nbsp;&nbsp;DCs have now been applied the same settings which are send LM and ntlm and use V2 if negotiated. The issue is intermitted as it it will work on a DC and then stop and then work again.&nbsp;&nbsp;Similar is on the end user devices.&nbsp;&nbsp;We have on prem DCs and all devices are in tuned and entra joined.We are hybrid but we do not sync or write the devices to ad.&nbsp;&nbsp;Replication and DFS itself are healthy.&nbsp;&nbsp;Issue are some users who have AFS paths already mapped to their devices it fails to connect to them sometimes. But new mapping works.&nbsp;&nbsp;Any ideas or assistance will be appreciated.&nbsp;

jamony · Answer

The selected setting is not NTLM hardening: “Send LM and NTLM, use NTLMv2 session security if negotiated” still allows LM and NTLM authentication. The intermittent failure of the domain DFS root, while child paths work, points toward inconsistent domain-controller referral or authentication paths rather than an unhealthy namespace. Enable NTLM auditing before denying anything and review the NTLM Operational log on domain controllers and namespace servers. During a failure, record the active domain controller, inspect the DFS referral cache, verify DNS and domain-controller connectivity, and test TCP 445 to the referred namespace server. Compare those results with a working attempt and check whether existing mapped paths contain stale referrals. Entra-joined devices that are not AD computer objects can follow a different authentication path, so confirm how the user obtains Kerberos tickets. Correct the inconsistent dependency first, then apply a consistent NTLMv2-only or deny policy in stages.

Forum Discussion

Root DFS and ntlm hardening

1 Reply