Cannot login SP2010 CA but able to login all other sites

Question

We are using SP2010 on-premise. On last weekend the server (both SharePoint and SQL are installed in same machine) was patched for some security hotfix and .net framework.

On Monday, we found we no longer able to login CA using Farm administrator account. We have tried login localhost or from a remote client PC (which can login before), it will show a password prompt 3 times.

We can successfully login with same login/password for all the other SharePoint sites on same farm. The right top corner will show the login is "System account". Hence the login/password have no problem.

It looks like everything is working beside we cannot open CA. What could be the problem? Is login to CA have different authentication protocol as other site collections?

Answer 1

I found that solution right after posting the question. In the IIS manager -> authentication -> provider. I found Negotiate is the 1st provider while NTLM is 2nd. Before patch, the CA only support NTLM. It seems the patch have forced CA to use Negotiate (kerbos) and cause we are not able to login.

Isn't the "providers" list a failover list? If Negotiate not work it should try NTLM. However it is not in my case. I have no idea.

In order to solve the issue, I simply swap the order for these 2 providers. Then I am able to login CA again.