There are several authentication encryption schemes available to Windows machines for use when connecting to another Windows machine to use shared resources. ACNS configured its systems to only support the newer NTLMv2 encryption algorithm for LAN Manager style authentication. This means all connections to our servers need to use NTMLv2 to be able to access shared files and printers. Users at home who wish to access files on CSUNTS, may need to configure their systems to use NTLMv2 if this is not autonegotiated.

Beginning with Windows 2000, the initial authentication when you logon to a domain uses Kerberos but many applications continue to use older encryption schemes and the operating system supports this. The other available encryption methods are LM, NTLM and NTLMv2. The older encryption methods are relatively easy to crack with modern equipment so security best practices recommend only using the more recent NTLMv2 encryption where LAN Manager authentication is required.

Windows 2000 and XP users can make a single registry change to use NTLMv2 but Windows 9X/ME/NT systems also require the Directory Services Client (DSClient) installed. You can either configure your computer to use NTLMv2 exclusively or to always sent NTLMv2 but allow LM and NTLM incoming connections. If you share file or printer resources from your home system, you either need to allow LM and NTLM or configure other systems that may access your home computer to use NTLMv2 as well. Windows 9x/ME systems can only be configured to accept use NTLMv2 but accept LM. Windows 2000 and XP systems can be configured for either.

You can either configure your Win2K/XP system to use NTLMv2 exclusively or send NTLMv2 and accept all authentication protocols. To configure your system, import the appropriate registry file:

• Send NTMLv2. Accept LM, NTLM and NTLMv2
• Use NTLMv2 Exclusively
• Default-Send LM and NTLM; never use NTLMv2

You can either configure your NT 4.0 system to use NTLMv2 exclusively or send NTLMv2 and accept all authentication protocols. To configure your system, import the appropriate registry file and install the Directory Services Client:

• Send NTMLv2. Accept LM, NTLM and NTLMv2
• Use NTLMv2 Exclusively
• Default-Send LM and NTLM; never use NTLMv2
• Directory Services Client

You can only control what protocols are used for outgoing connections on Windows 9x/ME clients. To configure your system, import the appropriate registry file and install the Directory Services Client:

• Send NTMLv2
• Default-Send LM and NTLM; never use NTLMv2
• Directory Services Client

• Windows Services Home
• Service Pricing and Info
• Email the Helpdesk
• Workstation Contract
• Unmanaged Workstations Contract
• LM Compatibility Settings