How to change the NTLM to Kerberos authentication in SharePoint 2013

Question

We have Configured the SharePoint 2013 with NTLM authentication. After few months our security team requests us to change the current authentication method from NTML to Kerberos in SP2013 hosted web apps, because of this news

Could you please advice us the steps and impact of changing the authentication?

Answer 1

It is easy to configure but little tricky.

• You have to create the SPN for the web application url (Short & FQDN).

  setSPN –S HTTP/PORTAL DOMAIN\PortalAppPool setSPN –S HTTP/PORTAL.DOMAIN.COM DOMAIN\PortalAppPool

• You have to delegate trust.

• You have to Create the DNS for SQL service account and Enable kerbros

• Change the Web application's authentication settings from NTLM to Kerbros.

• Now you have to test the configuration. You can check it via Security Event Log or run the Klist in command prompt to see the Kerb ticket.

Check these guide for complete understanding

The first Kerberos guide for SharePoint 2013

Configure Kerberos authentication (Office SharePoint Server)

Answer 2

From home of the SharePoint:

1. On the left, click on Security.
2. On the right, click on Specify authentication providers.
3. Click on Default.
4. There you will find it then change the authentication from NTLM to kerberos and vise versa.