IIS 7 - Change the order to NTLM authentication and the Negotiate

1
votes

Using the below commands i am able to add 'Negotiate' and 'NTLM' as providers to windows authentication

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='Negotiate'] /commit:apphost

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='NTLM'] /commit:apphost

My question is using the command line how can I change the order of the providers.. example i want 'NTLM' and then 'Negotiate'

2
iiswindows-authenticationprovider

2 Answers

1
votes

What Lex Li said is one way, but there are more ways to achieve this: First of all run the commands in the order you want the providers to be set. The first authentication method added will be on top. So if you run your command lines after creating the site and no providers have been set, change the current mentioned run order of the appcmd's.

Secondly you can only remove the authentication provider that you want to be second and then re-add that provider, because by removing and re-adding it, it will become second automatically:

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /-providers.[value='Negotiate'] /commit:apphost

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='Negotiate'] /commit:apphost

Thirdly you can do what Lex Li says: Remove all the providers:

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /-providers.[value='Negotiate'] /commit:apphost

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /-providers.[value='NTLM'] /commit:apphost

Add in correct order:

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='NTLM'] /commit:apphost

C:\Windows\SysWOW64\inetsrv\appcmd set config "Default Web Site/LIT/My.Site" -section:system.webServer/security/authentication/windowsAuthentication /+providers.[value='Negotiate'] /commit:apphost

The choice is yours.

0
votes

Remove both of them and then add in order.