Disable NTLM authentication (recommended)

Note: This section applies to those who use Windows authentication and wish to harden their security in PI Vision. The steps in this section do not apply if you use OpenID Connect authentication or Basic authentication. AVEVA recommends using OpenID Connect authentication whenever possible.

Some configurations of Windows Integrated Security (WIS) may cause the PI Vision server to fall back to NTLM authentication, a protocol that may be susceptible to replay attacks. For more information about how Microsoft is working to eliminate the need for NTLM, see the blog post The evolution of Windows authentication.

For increased security, we recommend that you remove the NTLM protocol by following these steps:

1. In Internet Information Services (IIS) Manager, select the PIVision site and double-click the Authentication icon under the features view.

   

2. Select Windows Authentication.

3. Select the Advanced Settings link from the right pane.

4. Deselect the checkbox for Enable Kernel-mode authentication. Select OK.

   This setting is not compatible with the Negotiate:Kerberos authentication provider.

5. Select the Providers link from the right pane.

6. Remove NTLM and Negotiate from the list of enabled providers.

7. Add the Negotiate:Kerberos provider. Select OK.