I want to create WebApplication in PowerShell (SharePoint 2013) with the recommended claims based authentication and using Kerberos (instead of default NTLM). Based on the documentation I used command that takes SPAuthenticationProvider as parameter to create claims based authentication and specify also authentication method to be Kerberos:

$ap = New-SPAuthenticationProvider
New-SPWebApplication -Name "qwe1" -Host "qwe1" -Url "http://qwe1.blah.int" -Port 80 -ApplicationPoolAccount (Get-SPManagedAccount "DOMAIN\account") -ApplicationPool "qwe1" -AuthenticationProvider $ap -AuthenticationMethod "Kerberos"

The behavior is a bit strange - first, it issues warning: WARNING: The Windows Classic authentication method is deprecated .. but creates WebApplication with claims based authentication. Second, the authentication method is NTLM, not Kerberos. Feels like Alice in Wonderland..

1 Answer 1


OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth.

To achieve my goal I need to use these commands:

$auth = New-SPAuthenticationProvider -DisableKerberos:$false
New-SPWebApplication -Name "t3" -Host "t3" -Url "http://t3.blah.int" -Port 80 -ApplicationPoolAccount (Get-SPManagedAccount "DOMAIN\account") -ApplicationPool "t3" -AuthenticationProvider $auth

For reference I'm adding also commands for changing existing WebApplication with claims based authentication from NTLM to Kerberos:

$auth = New-SPAuthenticationProvider -DisableKerberos:$false
Set-SPWebApplication t3 -Zone Default -AuthenticationProvider $auth

Hope it saves you some time..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.