IIS Managed Service Accounts скачать в хорошем качестве

IIS Managed Service Accounts

IIS Running an apppool with a managed service account is unable to authenticate a user using Kerberos Authentication. KRB_ERR_AP_MODIFIED is returned, with the computer account (computer$) in the error, when using a loadbalancer, DNS round robin, or DNS alias for the FQDN the website is being accessed as. This is because the kerberos ticket being sent is being passed to the app pool, and the app pool identity is unable to decode it. The solution is to disable kernel mode authentication on the server, which enables the apppool process to perform the decode of the kerberos ticket, rather than the IIS module (running as the computer account). There may be an alternative solution - e.g. the permissions on the computer account - I've not been able to find an alternative solution though.