1602: IIS Kerberos Authentication Broken?

[Businesskasper]

Hi,

 

I'm new here, please be gentle

 

Someone seems to have played with our SCCM IIS. I think Windows Authentication with Kerberos doesn't work anymore.

Login to the Application Catalog only works when you put "NTLM" over "Negotiate" in IIS.

The Distribution Point only works, when you allow Anonymous Authentication in SCCM - Distribution Points.

 

What doesn't work, is when Users try to reevaluate user policies.

 

PolicyAgent.log:

Synchronous policy assignment request with correlation guid {A16140B0-151C-4A9B-8A67-283CE38FEE8A} for User S-1-5-21-1960130858-3242946568-2400973019-36681 completed with status 80070005

 

 

I tried reinstalling Windows Authentication -> SCCM didn't work at all anymore, until I reregistered ASP.NET and other nasty Bits.

I tried reinstalling the Management Point -> Log says success, still users can't authenticate and can't get Policies.

 

Any Ideas? Can I just uninstall all System Roles, reinstall IIS and install System Roles again?

 

Thank you

 

Greetz

[Businesskasper]

Addition:

Everything works on the Site Server itself, not on Clients.

 

SCCClient_Domain@Username.log gives me:

 

Exception System.ServiceModel.Security.MessageSecurityException: Die HTTP-Anforderung ist beim Clientauthentifizierungsschema "Negotiate" nicht autorisiert. Vom Server wurde der Authentifizierungsheader "Negotiate oW0wa6ADCgEBomQEYmBgBgkqhkiG9xIBAgIDAH5RME+gAwIBBaEDAgEepBEYDzIwMTYwNzI2MDY0ODIwWqUFAgMNY6imAwIBKakMGwpHTE9CQUwuRlVNqhYwFKADAgEBoQ0wCxsJczAwLXNjY20k" empfangen. (Microsoft.SoftwareCenter.Client.ViewModels.ApplicationListViewModel+<LoadServiceApplicationsAsync>d__2f at MoveNext)

 

In English something like:

Exception System.ServiceModel.Security.MessageSecurityException: The HTTP-Request is not authorized on Clientauthentication scheme "Negotiate". Server received the Authenticationheader "Negotiate oW0wa6ADCgEBomQEYmBgBgkqhkiG9xIBAgIDAH5RME+gAwIBBaEDAgEepBEYDzIwMTYwNzI2MDY0ODIwWqUFAgMNY6imAwIBKakMGwpHTE9CQUwuRlVNqhYwFKADAgEBoQ0wCxsJczAwLXNjY20k". (Microsoft.SoftwareCenter.Client.ViewModels.ApplicationListViewModel+<LoadServiceApplicationsAsync>d__2f at MoveNext)

[GarthMJ]

 

The Distribution Point only works, when you allow Anonymous Authentication in SCCM - Distribution Points.

 

This is not best practice. You should use the Computer or Network Access account to access the DP.