A registry setting instructs the web server and domain controller to use certain versions of NTLM. If the web server and DC use versions that are incompatible with each other, NTLM authentication fails. Updates set the preference to “NTLMv2 only” (Registry value is 3) which may cause this incompatibility issue.
For example: If the domain controller (or client via GPO) is set to the value of 1 which means “send LM, NTLM and prohibit NTLMv2” and the server is set to the value of 5 which means “Only accept NTLMv2”, this issue may occur (Please see this article for the descriptions of each value).
DCs determine the minimum security requirements for NTLM authentication between a Windows client and the local Windows domain. Based on the minimum security settings in place, the DC can either allow or refuse the use of LM, NTLM, or NTLM v2 authentication, and servers can force the use of extended session security on all messages between the client and server. This is either set locally on the client or DC (LMCompatibilityLevel) or can be dictated by Group Policy.
A quick solution would be uninstalling the updates that cause this issue.
Another quick solution is to use Kerberos instead of NTLM. Please note that Kerberos require certain configuration (SPN settings) to work. If they are not present or misconfigured, Kerberos authentication will fail.
If you want to enable Kerberos, please move Negotiate to the top of the Providers list in Settings of Windows Authentication.
Install the corrective updates to solve this issue. For Windows Server 2016 Build 1607, here is the corresponding update: 4487026.
If you are not able to install it for any reason or you can’t find the update for your OS version, try to match the LmCompatibilityLevel value between your domain controller and IIS server. Check the values below and make sure there is no mismatch (Use the table in the link I mentioned above)
In the domain controller:
In the IIS server:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.