Petya V4sechkin, пробовал полностью отключать ESET Internet Security. Попробую также и удалить.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"auditbaseobjects"=dword:00000000
"auditbasedirectories"=dword:00000000
"crashonauditfail"=dword:00000000
"fullprivilegeauditing"=hex:00
"Bounds"=hex:00,30,00,00,00,20,00,00
"LimitBlankPasswordUse"=dword:00000001
"NoLmHash"=dword:00000001
"Notification Packages"=hex(7):73,00,63,00,65,00,63,00,6c,00,69,00,00,00,00,00
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
6e,00,65,00,6c,00,00,00,77,00,64,00,69,00,67,00,65,00,73,00,74,00,00,00,74,\
00,73,00,70,00,6b,00,67,00,00,00,70,00,6b,00,75,00,32,00,75,00,00,00,00,00
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00
"LsaPid"=dword:000002fc
"SecureBoot"=dword:00000001
"ProductType"=dword:00000006
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"forceguest"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"LmCompatibilityLevel"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders]
"MartaExtension"="ntmarta.dll"
"ProviderOrder"=hex(7):57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,4e,00,\
54,00,20,00,41,00,63,00,63,00,65,00,73,00,73,00,20,00,50,00,72,00,6f,00,76,\
00,69,00,64,00,65,00,72,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6e,00,74,00,6d,00,61,00,72,00,74,00,61,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy]
"AuditPolicySD"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,\
eb,01,00,00,00,0f,41,2e,f2,47,f9,08,4e,8f,2a,8f,65,df,60,3f,8d,00,00,00,20,\
1c,00,00,00,41,00,75,00,64,00,69,00,74,00,50,00,6f,00,6c,00,69,00,63,00,79,\
00,53,00,44,00,00,00,10,66,00,00,00,01,00,00,20,00,00,00,52,60,40,24,5e,30,\
6a,9d,5a,56,93,b0,dc,1b,7d,38,6d,47,11,24,6c,bb,7a,a8,c7,74,20,17,73,69,bd,\
ea,00,00,00,00,0e,80,00,00,00,02,00,00,20,00,00,00,e3,1a,4b,3a,21,86,6f,b1,\
ac,07,01,f7,2b,2e,e3,6e,1f,c9,de,1c,98,c0,35,ab,80,eb,b9,88,aa,d8,9d,b0,70,\
00,00,00,c7,d2,05,ca,d2,e5,79,20,d6,fc,c6,a9,d1,77,97,3b,c0,df,c7,36,2e,19,\
49,93,fa,64,c1,34,6a,f5,eb,45,95,46,21,01,e5,8d,9d,12,7e,86,e1,fd,ef,e6,c2,\
cd,be,e2,ad,fd,33,7f,df,b8,b9,2e,7b,0e,ac,e5,95,32,13,38,1c,c5,1d,58,5c,f7,\
9a,13,31,aa,38,17,98,9f,ae,cd,35,8c,9b,ff,54,20,99,b1,b8,4a,05,34,ac,92,3c,\
fd,32,7b,be,01,cd,9a,8d,8a,bd,3e,85,d2,9f,86,40,00,00,00,bb,99,42,a6,ff,3f,\
51,c8,fe,dc,26,61,d8,d7,7d,d6,e6,7d,fd,b8,ba,43,4f,0e,5f,48,53,6b,43,ae,35,\
e6,46,8d,9d,d7,19,5e,0d,63,1c,9c,df,0e,2e,d4,f5,d7,71,18,eb,92,4a,7c,49,1e,\
9a,41,f8,ec,00,f0,47,3c
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp]
"DebugLogLevel"=dword:00000000
"fCredentialLessLogonSupported"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentia ls]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentia lsDomain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentia lsWhenNTLMOnly]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentia lsWhenNTLMOnlyDomain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials Domain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials WhenNTLMOnly]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials WhenNTLMOnlyDomain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials Domain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials WhenNTLMOnly]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials WhenNTLMOnlyDomain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredential s]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredential sDomain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentials]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentialsD omain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentials]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentialsD omain]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data]
"Pattern"=hex:0a,53,56,61,b2,e9,ef,4f,5b,7f,5e,bb,5f,b5,84,af
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup"=hex:5c,cd,ee,21,22,d9,2c,c2,f1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD]
"Lookup"=hex:f5,7a,1d,76,ba,d1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\HostToRealm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
"Auth132"="IISSUBA"
"NtlmMinClientSec"=dword:20000000
"NtlmMinServerSec"=dword:20000000
"RestrictReceivingNTLMTraffic"=dword:00000002
"RestrictSendingNTLMTraffic"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix"=hex:00,53,26,34,6e,2d,b8,3e,f0,e2,d7,e8,34,77,22,2f
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache]
"Time"=hex:29,44,e8,a1,c3,3c,d2,01
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\credssp.dll]
"Name"="CREDSSP"
"Comment"="Microsoft CredSSP Security Provider"
"Capabilities"=dword:00010733
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:000090a8
"Time"=hex:2e,17,b5,c6,5c,3c,d2,01
"Type"=dword:00000021
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
77,00,6b,00,73,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"EnablePlainTextPassword"=dword:00000000
"EnableSecuritySignature"=dword:00000001
"RequireSecuritySignature"=dword:00000000
"OtherDomains"=hex(7):00,00
P.S.
Если информация будет полезной, то нашел кое-что в трассировщике событий:
NTLM client blocked: Outgoing NTLM authentication traffic to remote servers that is blocked.
Target server: cifs/KEENETIC
Supplied user: (NULL)
Supplied domain: (NULL)
PID of client process: 1076
Name of client process: C:\Windows\System32\svchost.exe
LUID of client process: 0x2495e
User identity of client process: Admin
Domain name of user identity of client process: ADMIN-HP
Mechanism OID: 1.3.6.1.4.1.311.2.2.10
NTLM authentication requests from this computer are blocked.
If you want to allow this computer to use NTLM authentication, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Allow all.
If you want only the target server cifs/KEENETIC to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all and then set the security policy Network Security: Restrict NTLM: Add remote server exceptions and list the target server cifs/KEENETIC as an exception to use NTLM authentication.
vBulletin v3.6.4, Copyright ©2000-2025, Jelsoft Enterprises Ltd.