I-LmCompatibilityLevel iyinqubomgomo ye-Windows, hhayi ukulungiswa kwe-VPN

Othile akakwazi ukufinyelela isabelo sefayela nge-VPN, ufunda ukuthi ukwehlisa i-LmCompatibilityLevel kulungisa izinkinga ze-NTLM, bese ekushintsha kuseva eyabiwe. Ngakusasa ekuseni ezinye izinhlelo ziyahluleka, futhi inkinga yokuqala isekhona. Lesi silungiselelo asikaze sibe iswishi yomhubhe ngamunye; isitatimende esisezingeni lomshini mayelana nokuthi yiziphi izimpendulo zokuqinisekisa le sistimu ezizozithumela futhi ezizozamukela. Ukukushintsha ukuze kulungiswe ukungena okukodwa kubhala kabusha imithetho yakho konke ukungena okwenziwa umshini.

Ukufunda amazinga abhaliwe iyona ndlela esheshayo yokuyeka ukuthatha inani lenqubomgomo njengenombolo yomlingo.

Amazinga amathathu, izethembiso ezintathu ezihlukene

Izinga 1 lenza iklayenti lithumele izimpendulo ze-LM ne-NTLM, lisebenzisa ukuphepha kwesikhathi se-NTLMv2 lapho izingxoxo zikuvumela. Izinga 3 lenza iklayenti lithumele izimpendulo ze-NTLMv2 kuphela, lokho akufani nokwenqaba zonke izimpendulo ezindala ohlangothini olwamukelayo. Izinga 5 ligcina iklayenti ku-NTLMv2 futhi lengeza ukwenqatshwa okubhaliwe kwe-LM ne-NTLMv1 yisilawuli sesizinda. Izinombolo ezintathu, futhi igebe phakathi kwazo isinqumo senqubomgomo hhayi ukuthanda.

Leyo mehluko ichaza ukuthi kungani ukukopisha inani esimweni esisebenzayo kungathenjwa. Ukuhambisa iklayenti elilungiswe kabi kusuka ku-1 kuya emgqeni wesisekelo ogunyaziwe kungase kube yikho okulungile. Ukuhambisa ukusatshalaliswa okuqinisiwe kusuka ku-5 kwehle ku-3 ngenxa nje yokuthi umucu we-forum wakhuluma nge-3 kuxegisa umngcele okhethwe ngumuntu ngamabomu, futhi kwenza lokho kuyo yonke insiza umshini okhuluma nayo.

Funda inqubomgomo esebenzayo, hhayi inani elilodwa lerejista

Ukubheka inani lendawo ngokufunda kuphela iyindawo yokuqala efanele: Get-ItemProperty -LiteralPath 'HKLM:\System\CurrentControlSet\Control\Lsa' -Name LmCompatibilityLevel. Ukungabikho kwenani akusho ukuthi inqubomgomo esebenzayo iwuziro, ngoba inqubomgomo yesizinda noma eyezokuphepha yendawo ingayibeka kwenye indawo, futhi indima yomshini ishintsha lokho okwenzayo ngaleyo nombolo.

Hlola inqubomgomo ephethwe, indima yesistimu kanye ne-build yangempela ngaphambi kokuphetha noma yini. Isiteshi somsebenzi nesilawuli sesizinda esinenani elifanayo ziziphatha ngendlela ehlukile ekugcineni okuphezulu, futhi yilokho abantu abakukhohlwayo lapho beqhathanisa imishini emibili.

Khomba ukuthi yikuphi ukuqinisekisa okuhlulekile ngempela

Izinkinga zamathikithi e-Kerberos, ukwenqatshwa kwe-NTLM nokuhluleka kokungena nge-VPN kudinga ubufakazi obuhlukene. Gcina insiza eqondiwe, i-akhawunti kanye nephutha eliqondile ndawonye kunothi elilodwa, bese ubheka lokho insiza ekucelile hhayi lokho iklayenti elikuthandayo. Lelo nothi elilodwa livimbela isinyathelo esingalungile esivame kakhulu, okuwukushintsha inani ohlangothini lweklayenti ukuphendula ukwenqatshwa ohlangothini lweseva.

Ukwehlisa inqubomgomo kaningi kuze kudlule iphutha lokungena elijwayelekile akusikona ukuxilonga; kuwushintsho olufihla ubufakazi. Uma uhlelo lusebenzisa i-Kerberos, izinga lokuhambisana ne-NTLM akusiyo ngisho isilawuli esifanele, futhi uxegise umngcele ize.

Okunye ukusekelwa kweprotocol akukwazi ukubuyiswa

I-Windows 11 24H2 ne-Windows Server 2025 azisakufaki nhlobo ukuqinisekisa kwenethiwekhi kwe-NTLMv1. Ayikho inombolo yokuhambisana ebuyisela iprotocol engasayisebenzisi i-build, ngakho ukwehliswa okwasiza kunguqulo endala kuzohluleka nje kunguqulo entsha. I-Microsoft ibhala lokho kususwa ngokwehlukile kusilungiselelo senqubomgomo, futhi ukuhlanganisa kokubili kuveza izeluleko ezingakwazi ukusebenza.

Umkhawulo ohlobene kodwa ohlukile usebenza kumakhredenshi asuselwa ku-NTLMv1 asetshenziswa ukungena okukodwa okusekelwe ku-MSCHAPv2. Kuwumbuzo wamakhredenshi asusiwe, hhayi iprotocol yenethiwekhi ngokwayo, futhi hhayi leli nani lerejista. Ukuthatha kokuthathu njengesihloko esisodwa iyona ndlela izinhlangano ezigcina ngokwenza buthaka isilawuli esisodwa ngenkathi zizama ukulungisa esinye.

Kushintshe ngomnikazi, bese uhlola zombili izinhlangothi

Uma ukulungiswa kudingeka ngempela, kwenze ngomnikazi wenqubomgomo ukuze umgqo wesisekelo uhlale uhambisana, futhi bhala ukuthi kungani. Bese uhlola uhlelo olugunyaziwe ngaphansi kwesilungiselelo esisha kanye necala lokuqinisekisa elivinjelwe ngamabomu, ngoba ushintsho olulungisa isabelo esisodwa futhi luvumele ngokuthula izimpendulo ezindala kwenye indawo akusona impumelelo. Ukuxhumana kwe-VPN okusebenzayo kufakazela ukuthi ukungena kuphumelele. Akukuqinisekisi inqubomgomo yokuqinisekisa yomshini, futhi ngokuqinisekile akubonisi ukuthi yonke insiza engemuva kwayo isaziphatha ngendlela eyaklanywa ngayo.

Uma insiza ehlulekayo isekelwe ku-Kerberos, yeka ngokuphelele ukubheka lesi silungiselelo. Uma kuyithuluzi elidala elingakwazi ukwenza kangcono ngempela, bhala lokho kukhishwa futhi unqume ububanzi bawo, ngoba enye indlela umgqo wesisekelo owenziwe buthaka ngokuthula okungekho muntu okhumbulayo ukuthi wagunyazwa.