After installing February 2019 updates to your IIS Server, Windows Authentication in your web application may stop working. End-users may notice a delay and an authentication error following it. This is caused by a known issue about the updates.
Background
A registry setting instructs the web server and domain controller to use certain versions of NTLM. If the web server and DC use versions that are incompatible with each other, NTLM authentication fails. Updates set the preference to “NTLMv2 only” (Registry value is 3) which may cause this incompatibility issue.
For example: If the domain controller (or client via GPO) is set to the value of 1 which means “send LM, NTLM and prohibit NTLMv2” and the server is set to the value of 5 which means “Only accept NTLMv2”, this issue may occur (Please see this article for the descriptions of each value).
More information:
DCs determine the minimum security requirements for NTLM authentication between a Windows client and the local Windows domain. Based on the minimum security settings in place, the DC can either allow or refuse the use of LM, NTLM, or NTLM v2 authentication, and servers can force the use of extended session security on all messages between the client and server. This is either set locally on the client or DC (LMCompatibilityLevel) or can be dictated by Group Policy.
Quick solutions
A quick solution would be uninstalling the updates that cause this issue.
Another quick solution is to use Kerberos instead of NTLM. Please note that Kerberos require certain configuration (SPN settings) to work. If they are not present or misconfigured, Kerberos authentication will fail.
If you want to enable Kerberos, please move Negotiate to the top of the Providers list in Settings of Windows Authentication.
Permanent Solution
Install the corrective updates to solve this issue. For Windows Server 2016 Build 1607, here is the corresponding update: 4487026.
If you are not able to install it for any reason or you can’t find the update for your OS version, try to match the LmCompatibilityLevel value between your domain controller and IIS server. Check the values below and make sure there is no mismatch (Use the table in the link I mentioned above)
In the domain controller:
- Check the value of this GP policy setting:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network security: LAN Manager authentication level - Check the value of this registry key:
HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel
In the IIS server:
- Check the value of this registry key:
HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel