Detecting Kerberos and / or NTLM Authentication Errors in Custom Application Packages Written with the WISE Packaging Installer
We are seeing Kerberos and / or NTLM authentication errors in custom app packages built for Windows 7 using the WISE installer for packaging. They work fine on Windows 7, but now they fail on Windows 10. They do not work during installation on Windows 10 using the Microsoft SCCM tool, and they do not work when using Kerberos authentication in SMB Share on the network. We can see inside the network trace that the client application crashes on NTLM from Kerberos, which allows an authentication transaction to be performed. We're not sure why. We have a large scale Active Directory environment. Since the WISE package is comiled, we cannot look at it. On successful Windows 7 machines, it appears that the computer requires access to Share while the package is being executed, and the user who failed to login appears tomust have read and execute access in SMB Share. We can access the same SMB Share using the Windows 7 system account, but not using the Windows 10 system account. Very strange! Is this a problem with the code inside the package? This might be important: the SMB share is using a DNS alias, but not sure if it matters. The real hostname is different. By using a real hostname instead of an alias, the access issue appears to be resolved.The real hostname is different. By using a real hostname instead of an alias, the access issue appears to be resolved.The real hostname is different. By using a real hostname instead of an alias, the access issue appears to be resolved.
source to share
A network share won't accidentally be hosted by a non-Windows server, will it? If so, see if this article applies:
Shared SMB file server cannot be accessed using DNS CNAME aliases
Basically there has been a change in the Windows 10 security model. Windows 10 will not by default request a Kerberos ticket for a DNS alias, but Windows 7 will. The SMB server basically says, since you are not using my actual name (as shown in the service ticket), I will not allow the connection. Create a new SPN using the name that successful Windows 7 machines connect to, but in the form of an SPN. For example, if Windows 7 uses something like this:
\ servername.domain.com \ share_name
.. then find that name of the AD computer object representing the host and add a secondary SPN to this AD object, for example:
HOST / servername.domain.com
source to share