Tools

Disable NTLM and use Kerberos with Dameware MRC – SSO behavior, limitations, and workarounds

When NTLM is disabled in the environment, Dameware Mini Remote Control (MRC) can still authenticate using Kerberos via Encrypted Windows Logon against domain‑joined machines, but true SSO using “Use current logon credentials” is not supported in this mode. SSO in Dameware currently requires Windows NT Challenge/Response, which depends on NTLM.

First published date

3/6/2026 9:31 PM

Last published date

3/6/2026 9:31 PM

Overview

When hardening their Windows environments, you may:

  • Disable NTLM and require Kerberos‑only authentication.

  • Want Dameware MRC to:

    1. Use Kerberos, and

    2. Provide SSO (no credential prompt) from the technician’s logged‑in user.

In Dameware 12.3:

  • Kerberos support (with NTLM disabled) is available via Encrypted Windows Logon when connecting to domain‑joined machines.

  • SSO / “Use current logon credentials” is implemented only for Windows NT Challenge/Response, which uses NTLM.

  • For DMRC 12.3.1 + Windows 11 + NTLM disabled, there is a bug (DW‑1756) where the Kerberos path does not work, and only NTLM authentication is functional.

As a result, the specific combination “Kerberos + NTLM disabled + true SSO” is not supported today.

Product section

Dameware Remote Support & Mini Remote Control

Cause

  1. Design limitation (SSO binding to NTLM)

    • “Use current logon credentials” is only available when the authentication type is Windows NT Challenge/Response.

    • Encrypted Windows Logon is designed to allow passing explicit credentials (user enters username/password), and does not expose “Use current logon credentials.”

  2. Security hardening (NTLM disabled)

    • When domain GPOs restrict or disable NTLM, Windows NT Challenge/Response–based authentication either fails or is blocked, so the SSO path that depends on NTLM cannot be used.

  3. Known issue in DMRC 12.3.1 with Windows 11 and NTLM disabled

    • In this combination, the alternate Kerberos authentication methods are not working properly, so only NTLM succeeds.

    • With NTLM disabled, both Windows NT Challenge/Response and Encrypted Windows Logon fails on affected Windows 11 machines.

Resolution

Resolution / options

Option 1 – SSO is required, NTLM can remain enabled

Goal: True SSO, minimal prompts.

  • Set Authentication Type to Windows NT Challenge/Response.

  • Check “Use Current Logon Credentials” in:

    • Default Host Properties → Authentication Options, and/or

    • Remote Connect dialog for specific hosts (with “Remember Security Credentials” where applicable).

  • Result:

    • Dameware uses the logged‑in Windows user and provides SSO.

    • Requirement: NTLM must be allowed between technician workstation and target.

Option 2 – NTLM must be disabled (Kerberos‑only), SSO not required

Goal: No NTLM, but Kerberos is acceptable; credential prompt is acceptable.

  • Set Authentication Type to Encrypted Windows Logon.

  • On domain‑joined targets:

    • Windows uses the Negotiate package to prefer Kerberos.

    • Per the public KB, this works with NTLM traffic disabled.

  • Technicians enter their domain credentials explicitly (or use a password manager / secure credential store).

  • Result:

    • Meets “no NTLM” requirement.

    • Provides Kerberos‑based authentication.

    • Limitation: No SSO (no “Use current logon credentials” support in this mode).

Option 3 – DMRC 12.3.1 + Windows 11 + NTLM disabled

Goal: Operate in an environment affected by the known issue.

Short‑term choices:

  1. Temporarily re‑enable NTLM (scoped via GPO, firewall, or exceptions) for Dameware connections:

    • Use Windows NT Challenge/Response + “Use Current Logon Credentials” for SSO.

    • Accept that NTLM is used for these connections until an updated DMRC version resolves this issue.

  2. Avoid the impacted combination while keeping NTLM disabled:

    • Connect from a different OS/version not affected by the issue where Encrypted Windows Logon + Kerberos still works.

Supporting documentation and references