Another observation is once the same forest RDP worked on the remote host, cross-forest RDP connection on the remote host with the blocked inbound NTLM will now work.What did work is if I try to RDP from the same forest to the remote host, it will allow the connection and I can confirm it is using Kerberos for RDP instead of NTLM.I have also tried setting the policy on the remote host to use SSL for "Require use of specific security layer for remote (RDP) connections", and I still got the same CredSSP error.I have tried applying "Allow delegating fresh credentials" via policy on the remote host but it is still getting the CredSSP error.Turning off NLA on the remote host as a workaround will allow cross-forest RDP.Setting Encryption Oracle Remediation to either Mitigated or Vulnerable as a workaround did not work.RDP'ing to the remote host with inbound NTLM blocked via cross-forest generated a CredSSP error message.In our lab testing we have encountered the following when blocking inbound NTLM on a remote host: We are in the process of turning off NTLM in our environment for both inbound and outbound traffic via GPO.
0 kommentar(er)
