Synology DSM 7.0 and Windows Server NTLM

Question

Synology DSM 7.0 and Windows Server NTLM

Jakub Żylak 6

Hi,

as I know, in DSM 7.0 only NTLMv2 is supported by default.

I have Windows Server 2012 with Local Security Policy Network security: LAN Manager authentication level sets as Send NTLM response only

Here is the Microsoft explanation: Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

My question is, why I can`t connect to Synology using SMB if Synology DSM 7.0 is a server with NTMLv2 support and Windows Server 2012 should use NTLMv2 session security if the server supports it, because Windows Server 2012 Local Security Policy Network security: LAN Manager authentication level is set as Send NTLM response only (in according to Microsoft explanation: Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it)?

When I enable NTLMv1 authentication in Synology DSM 7.0 SMB settings, everything works fine.

2 answers

Your answer

Answer 1

Limitless Technology 39,861

Hello @Jakub Żylak

For certain application you will need to set up the policy as "Send NTLMv2 response only\ refuse LM & NTLM" for this security policy "Network security: LAN Manager authentication" in Local Security Settings > Local Policies > Security Options.

At the same time, 3rd Party applications will also have specific settings to transmit only using NTLMv1 or not, for which I would recommend you to promp your question or contact the software manufacturer (Synology) for assitance.

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

Jakub Żylak 6 Reputation points

2022-02-21T21:26:15.51+00:00

Thanks for Your reply.

Could You also explain what this exactly means:

Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it - does it mean, that client devices normally use NTLMv1 but when server supports NTLMv2, clients automatically should use NTLMv2 ?

In theory, this two options should work the same:

Send NTLM response only
Send NTLMv2 response only

in according to Microsoft explanation, if server supports NTLMv2, client devices should use NTLMv2 but in practise, it doesnt work and I have to set Send NTLMv2 response only\ refuse LM & NTLM as you mentioned above.

Is it a difference between NTLMv2 authentication and NTLMv2 session security ?

Answer 2

you should try this in your Synology NAS,

Configure settings for legacy devices

Warning: Enabling NTLMv1 is insecure and could make your Synology NAS vulnerable to attacks.

Most legacy devices (e.g., IP cameras, multi-functional printers, multimedia players) only support SMB1 and NTLMv1, and do not allow the customization of NTLM settings. For better security, we recommend replacing legacy devices or contacting the device manufacturers to request support for NTLMv2.

As a last resort, you can go to DSM > Control Panel > File Services > SMB > Advanced Settings > Others to tick Enable NTLMv1 Authentication. This will lower the security level but allow legacy devices to authenticate via NTLMv1.

https://kb.synology.com/es-mx/DSM/tutorial/I_cannot_access_shared_folders_from_WinXP_computer

Share via

Synology DSM 7.0 and Windows Server NTLM

2 answers

Your answer