To add a mapping, enable the policy setting, note the syntax, and then click Show.

To view the list of mappings, enable the policy setting and then click the Show button. If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.

GP Friendly name: Support device authentication using certificate.

If you don't configure this policy setting, Automatic will be used. If you disable this policy setting, certificates will never be used. If a DC can't be found which support computer account authentication using certificates, then authentication will fail.

Force: Device will always authenticate using its certificate.

If the DC doesn't support computer account authentication using certificates, then authentication with password will be attempted.

Automatic: Device will attempt to authenticate using its certificate.

If you enable this policy setting, the device's credentials will be selected based on the following options: This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.

Support for device authentication using certificate will require connectivity to a DC in the device account domain that supports certificate authentication for computer accounts.

GP Friendly name: Always send compound authentication firstĪDMX_Kerberos/DevicePKInitEnabled Edition.

If you disable or don't configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication. If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request. For a domain controller to request compound authentication, the policies 'KDC support for claims, compound authentication, and Kerberos armoring' and 'Request compound authentication' must be configured and enabled in the resource account domain.

Kerberos client windows