通过集成Windows验证(Integrated Windows authentication)验证客户请求时IIS传递Negotiate安全头(security header).Negotiate 安全头让客户选择Kerberos验证还是NTLM验证.除了以下情形外Negotiate过程一般都选择Kerberos验证:
1.参与验证的一方系统不能使用Kerberos验证;
2.调用顺序不能提供足够的信息以使用Kerberos验证


要使Negotiate过程选择Kerberos验证客户顺序必须提供SPN(service principal name),UPN(user principal name)或NetBIOS帐号.否则Negotiate过程将优先使用NTLM协议.


IIS7.0
查看NTAuthenticationProviders:
c:\windows\system32\inetsrv\appcmd list config /section:windowsAuthentication

设置NTAuthenticationProviders:
c:\windows\system32\inetsrv\appcmd clear config /section:windowsAuthentication
c:\windows\system32\inetsrv\appcmd set config /section:windowsAuthentication -+providers.[value='Negotiate']
c:\windows\system32\inetsrv\appcmd set config /section:windowsAuthentication -+providers.[value='NTLM']

使用Appcmd.exe在IIS7.0中禁用Windows验证


1.cd %SystemRoot%\System32\inetsrv

2.更改设置:
appcmd.exe set config /section:windowsAuthentication /enabled:false

3.查看更改后的设置:

appcmd list config /section:windowsAuthentication


IIS6.0:
查看NTAuthenticationProviders:
cscript adsutil.vbs get w3svc/WebSite/root/NTAuthenticationProviders

设置NTAuthenticationProviders:
cscript adsutil.vbs set w3svc/WebSite/root/NTAuthenticationProviders "NegotiateNTLM"

IIS5.0或5.1
查看NTAuthenticationProviders:
cscript adsutil.vbs get w3svc/NTAuthenticationProviders

设置NTAuthenticationProviders:
cscript adsutil.vbs set w3svc/NTAuthenticationProviders "NegotiateNTLM"