Cannot Log In to ARM When User Is in "Protected Users" AD Group or NTLM Authentication Is Disabled

This article will help you solve the login issue in ARM when the user is a member of the AD security group "Protected Users", or NTLM authentication is disabled

• When users are part of this special security group, NTLM is restricted, and logging in using NTLM fails.
• Log in to ARM will also fail if NTLM authentication is disabled and Kerberos is not forced.

The solution is to implement the configuration switch which would force the Kerberos authentication and prevent the user login fail.

To configure this you will need to change the following files on the ARM server:

• C:\ProgramData\protected-networks.com\8MAN\cfg\pnServer.config.xml 
• C:\ProgramData\protected-networks.com\8MAN\cfg\pnCollector.Config.xml

The pnServer.config.xml file should already be in there and you will need to add the following code before </config>:
 

<options.useDirectActiveDirectorySecurity type="System.Boolean">False</options.useDirectActiveDirectorySecurity>

The pnCollector.Config.xml by default is not present in the ProgramData path and you should create one with the following content:
 

<?xml version="1.0" encoding="utf-8"?>
<config>
     <options.useDirectActiveDirectorySecurity type="System.Boolean">False</options.useDirectActiveDirectorySecurity>
</config>

If you are using the additional collectors, you should create C:\ProgramData\protected-networks.com\8MAN\cfg\pnCollector.Config.xml on each collector and add the code above. For the collector we only need pnCollector.Config.xml.

There is no need for ARM service restart and the change should be applied right after you save the change.
Once you have adjusted the configuration files, you can verify if you are able to successfully log in.