# NTLM Authentication Flow (slow):
# 1. Client sends credentials to Exchange
# 2. Exchange contacts Domain Controller
# 3. DC validates credentials
# 4. DC responds to Exchange
# 5. Exchange allows access
# = 2 network round trips per authentication

# Kerberos Authentication Flow (fast):
# 1. Client obtains ticket from DC (cached)
# 2. Client presents ticket to Exchange
# 3. Exchange validates ticket locally
# = 1 round trip, ticket reused for duration

# Check IIS authentication settings
Import-Module WebAdministration
Get-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter system.webServer/security/authentication/windowsAuthentication -Name providers | ForEach-Object { $_.Collection }

# Check for NTLM vs Negotiate
Get-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site" -Filter system.webServer/security/authentication/windowsAuthentication -Name enabled

# On Domain Controller, check authentication statistics
Get-Counter -Counter "\Security System-Wide Statistics\NTLM Authentications", "\Security System-Wide Statistics\Kerberos Authentications" -SampleInterval 5 -MaxSamples 10 | ForEach-Object {
    $_.CounterSamples | Select-Object Path, CookedValue
}

# High NTLM relative to Kerberos indicates bottleneck

# Check SPNs for Exchange server
$exchangeServer = $env:COMPUTERNAME
setspn -L $exchangeServer

# Check for HTTP SPNs (needed for Kerberos)
# Should see: HTTP/mail.domain.com, HTTP/servername.domain.local

# Check for duplicate SPNs (breaks Kerberos)
setspn -X

# From client, check if Kerberos ticket exists for Exchange
klist tickets | Select-String "exchange|mail|http"

# If no ticket, Kerberos is not working
# Get a ticket manually
klist get http/mail.domain.com

# Check from Outlook connection status
# Ctrl+Right-click Outlook tray > Connection Status > Authn column should show "Nego""Nego"

# Configure IIS to use Negotiate (Kerberos preferred)
Import-Module WebAdministration

# Set authentication for OWA
$sites = @("owa", "ecp", "ews", "Microsoft-Server-ActiveSync"-ActiveSync", "rpc", "mapi")
foreach ($site in $sites) {
    $path = "IIS:\Sites\Default Web Site\$site"
    if (Test-Path $path) {
        # Remove NTLM-only and add Negotiate
        Set-WebConfigurationProperty -PSPath $path -Filter system.webServer/security/authentication/windowsAuthentication/providers -Name "." -Value @{value="Negotiate"}
        Write-Host "Configured $site for Negotiate"
    }
}

iisreset /noforce

# Register SPNs for Exchange
# Run on Domain Controller as Domain Admin

$exchangeServer = "EXCH01"
$exchangeFQDN = "exch01.domain.local"
$externalNames = @("mail.domain.com", "autodiscover.domain.com", "owa.domain.com")

# Register server name SPNs
setspn -S HTTP/$exchangeServer $exchangeServer
setspn -S HTTP/$exchangeFQDN $exchangeServer

# Register external name SPNs
foreach ($name in $externalNames) {
    setspn -S HTTP/$name $exchangeServer
    Write-Host "Registered SPN: HTTP/$name"
}

# Verify SPNs
setspn -L $exchangeServer

# For load-balanced Exchange, use Alternate Service Account (ASA)
# Create ASA credential object

# On all Exchange servers, set the same ASA
$credential = Get-Credential -Message "Enter ASA credentials"

# Configure ASA on each CAS
Set-ClientAccessService -Identity EXCH01 -AlternateServiceAccountCredential $credential
Set-ClientAccessService -Identity EXCH02 -AlternateServiceAccountCredential $credential

# Register SPNs to ASA account instead of individual servers
$asaAccount = "DOMAIN\ExchangeASA"
$loadBalancerName = "mail.domain.com"
setspn -S HTTP/$loadBalancerName $asaAccount

# If Kerberos cannot be used, optimize NTLM

# Ensure Exchange servers have nearby DC connectivity
nltest /dsgetdc:domain.local /force

# Add RODC in remote offices to reduce NTLM latency

# Configure Extended Protection for Authentication
Get-OutlookAnywhere | Set-OutlookAnywhere -ExtendedProtectionFlags None -ExtendedProtectionSPNList $null -ExtendedProtectionTokenChecking None

# Consider enabling NTLM v2 only (more secure and faster)
# Via Group Policy: Network Security: LAN Manager authentication level
# Set to: Send NTLMv2 response only. Refuse LM & NTLM

# Check authentication counters after changes
Write-Host "Monitoring authentication for 60 seconds..."
$samples = Get-Counter -Counter "\Security System-Wide Statistics\NTLM Authentications", "\Security System-Wide Statistics\Kerberos Authentications" -SampleInterval 10 -MaxSamples 6

$samples | ForEach-Object {
    $ntlm = ($_.CounterSamples | Where-Object { $_.Path -like "*NTLM*" }).CookedValue
    $kerb = ($_.CounterSamples | Where-Object { $_.Path -like "*Kerberos*" }).CookedValue
    Write-Host "NTLM: $ntlm / Kerberos: $kerb"$kerb"
}

# On client, verify Kerberos ticket
klist tickets | Select-String "http"

# Check Outlook connection status shows "Nego" authentication