Azure MFA extension for NPS not working after disabling NTLMv1

Oddiraju, Kiran 6 Reputation points
2022-09-22T16:25:08.387+00:00

Hello Chaps,

Yesterday we disabled NTLM 1 at the Domain level and we noticed this morning the Azure MFA plugin installed on NPS server stopped working. Tried uninstalling the plugin and install the latest version from Microsoft but that didn't help. The error message on NPS logs was "An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request". We had to re-enable NTLM v1 to get the MFA working. Is there a way to force the plugin to use NTLM v2 or Kerberos for authentication? Operating system is Windows 2012 R2.

Thanks,
Kiran

Windows Server Infrastructure
Windows Server Infrastructure
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Infrastructure: A Microsoft solution area focused on providing organizations with a cloud solution that supports their real-world needs and meets evolving regulatory requirements.
526 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,350 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 30,251 Reputation points Microsoft Employee
    2022-09-26T06:47:59.993+00:00

    @Oddiraju, Kiran Apologies for the delay in responding to this post. Let me do a repro this scenario in my lab.

    Please help me with OS details on the server/client logs at the time of issue to investigate further.

  2. Tommy H 1 Reputation point
    2022-09-29T07:40:21.077+00:00

    We have the same issue, but on a new install.

    Server 2022, nps with latest NPS azure plugin. Our AD is not supporting NTLM V1 (V1 disabled), and we get the same error "An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request".

    The error comes when users is connecting and trying to get validated through a vpn client.

    Following this thread to see if any solution comes up.

    0 comments
  3. Givary-MSFT 30,251 Reputation points Microsoft Employee
    2022-09-29T08:07:31.237+00:00

    @Oddiraju, Kiran Just wanted to check whether primary authentication is working or not.

    Determine if Primary Authentication is working:
    Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
    Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
    Restart the Network Policy Service (IAS) service for the changes to take effect
    Determine if primary authentication for VPN is successful.

    Let me know the results for this scenario.

    0 comments
  4. Givary-MSFT 30,251 Reputation points Microsoft Employee
    2022-09-29T08:08:00.09+00:00

    @Tommy H Just wanted to check whether primary authentication is working or not.

    Determine if Primary Authentication is working:
    Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
    Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
    Restart the Network Policy Service (IAS) service for the changes to take effect
    Determine if primary authentication for VPN is successful.

    Let me know the results for this scenario.

  5. Nick Doud 6 Reputation points
    2023-10-16T16:18:47.8466667+00:00

    If I delete the registry entries:

    Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters

    AuthorizationDLLs

    ExtensionDLLs

    I can get the NPS service to start.

    However they are required to do Azure MFA, and when I put them back I can't get the NPS service running again.

    0 comments