Browser Configuration
The Connect with my Windows account login option uses Windows integrated authentication (Kerberos or NTLM). Browsers only send the user's Windows credentials automatically to sites they have been told to trust. For any other site, the browser either prompts the user for a Windows user name and password or doesn't send credentials at all; in that case the Web Console returns to the login page with the message "Your browser did not provide your Windows credentials."
The examples below use server1.example.com for the address of the Web Console.
Choosing the Server Address
- Use the server's fully qualified name (e.g. server1.example.com). Browsers can then use Kerberos. With a short name (server1) or an IP address, they fall back to NTLM, and some browsers need extra settings to allow short names (see Firefox below).
- The browser settings match host names, not ports, so you don't need to include the Web Console's port number.
- Users testing on the server itself can use localhost, which Edge and Chrome trust by default.
Microsoft Edge and Google Chrome
For Edge and Chrome, two options are available to make the Web server trusted:
Option 1: Assign the site to the Local Intranet zone
In a Group Policy Object, go to Computer Configuration (or User Configuration) > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List.
Enable the policy and add an entry with the site address as the Value name and 1 (Local Intranet) as the Value:
| Value name | Value |
|---|---|
| https://server1.example.com | 1 |
| http://server1.example.com | 1 |
You can also use a wildcard such as *.example.com to add every server in the domain. Note that when this policy is set, users can no longer add their own sites to zones. The Local Intranet zone's default Logon setting, Automatic logon only in Intranet zone, must not have been changed.
For a single computer without Group Policy, open Internet Options (run inetcpl.cpl) and go to Security > Local intranet > Sites > Advanced, and add the address.
Option 2: Set the authentication server allow list
These policies only affect the browser. They need the Edge or Chrome administrative templates (ADMX files), which you can download from Microsoft and Google.
| Browser | Group Policy setting | Registry value (REG_SZ) |
|---|---|---|
| Edge | Administrative Templates > Microsoft Edge > HTTP authentication > Configure list of allowed authentication servers | HKLM\SOFTWARE\Policies\Microsoft\Edge
AuthServerAllowlist |
| Chrome | Administrative Templates > Google > Google Chrome > HTTP authentication > Authentication server allowlist | HKLM\SOFTWARE\Policies\Google\Chrome
AuthServerAllowlist |
The value is a comma-separated list of host names, and may include wildcards, for example: server1.example.com,*.example.com
Mozilla Firefox
Firefox doesn't use the Windows zones, and by default doesn't send Windows credentials to any site. Configure the sites it trusts using one of the options below. Each list is comma-separated; an entry matches that host name and any name ending with it, so example.com covers server1.example.com.
Option 1: Group Policy
Install the Firefox administrative templates (ADMX files) from Mozilla's policy-templates project. Then open: Computer Configuration > Administrative Templates > Mozilla > Firefox > Authentication
| Setting | Value |
|---|---|
| SPNEGO | Enable, and add server1.example.com. This allows Kerberos. |
| NTLM | Enable, and add server1.example.com. This allows NTLM, which is used for short names, IP addresses, and when Kerberos isn't available. |
| Allow Non FQDN | Enable both options if users connect with a short name such as server1. |
The equivalent registry values are under HKLM\SOFTWARE\Policies\Mozilla\Firefox\Authentication: the SPNEGO and NTLM subkeys each contain REG_SZ values named 1, 2, and so on, one per site.
policies.json
Without Group Policy, create distribution\policies.json in the Firefox installation folder (e.g. C:\Program Files\Mozilla Firefox\distribution\policies.json):
{
"policies": {
"Authentication": {
"SPNEGO": [ "server1.example.com" ],
"NTLM": [ "server1.example.com" ],
"AllowNonFQDN": { "SPNEGO": true, "NTLM": true }
}
}
}Leave out AllowNonFQDN if users always use the fully qualified name.
Option 2: Individual users
A user can configure Firefox in about:config: add the server to network.negotiate-auth.trusted-uris and network.automatic-ntlm-auth.trusted-uris, and for a short server name set network.automatic-ntlm-auth.allow-non-fqdn to true. Settings made by policy take precedence and can't be changed by the user.
Checking the Configuration
- Restart the browser after a policy changes. Run gpupdate /force on the client to apply Group Policy changes immediately.
- In Edge and Chrome, open edge://policy or chrome://policy to confirm that the policy is applied. In Firefox, open about:policies.
- On the login page, choose Connect with my Windows account. If the browser is configured correctly, the console opens without a prompt.
- To confirm that Kerberos was used rather than NTLM, run klist on the client after logging in; a ticket for HTTP/server1.example.com should be listed.