Hello, friend!
This post will share with you a case about the LiteAD.
Issue Description
In LiteAD scenarios, when the LAN Manager authentication level is set to Send LM & NTLM responses in the local policy of a VM, the account will be locked if the user logs out of or logs in to the VM or logs in to the VM for six times using mstsc within 15 minutes.
NTLM is a hash algorithm used for account authentication. It is used by the operating system earlier than Windows 2003. The security level is low. The NTLMv2 is recommended for the operating system later than Windows 2007. This mode is more secure.
Key Word
LiteAD, account locking, NTLM, LAN management
Applicable Version
R6C10 and later versions
Problem Analysis
LiteAD does not support login in NTLM mode by default in 4.0.5 and later versions. Only the NTLMv2 mode is supported. Therefore, if the user group policy is set to LM and NTLM login mode, the login fails. More than five login failures within 15 minutes will cause the account to be locked.
Solution
Solution 1:
Change the customer VM or template group policy to support only the NTLMv2. The customer needs to confirm whether NTLM is required. If no, perform the following operations:
1. Log in to the faulty VM as an administrator.
2. In the Run dialog box, enter gpedit.msc to open the local policy.
3. Choose Security Settings > Local Policies > Security Options and then locate "Network security: LAN Manager authentication level" security policy.
4. In the Properties dialog box, select Send NTLMv2 response only, click Apply, and click OK.
Solution 2:
If the customer needs to use the NTLM, you can modify the LiteAD to be compatible with this algorithm, but the security level is low. Perform the following steps:
1. Log in to the LiteAD server as user gandalf and switch to user root.
2. Run the following command to use the vi editor to modify the smb.conf configuration file:
vi /etc/samba/smb.conf
3. Add the following configuration items to the configuration file, save the settings, and exit:
lanman auth = yes
ntlm auth = yes
raw NTLMv2 auth = yes
As shown in the following figure:
4. Run the following command to restart the service:
service samba-ad restart
5. Modify the standby LiteAD server by referring to steps 1 to 5.
That's all, thanks!
