Stronger NTLM session security supported for Load Tester 5.4
Let’s say you’re testing an internal site which uses Integrated Windows Authentication. You may have already been running regular tests on this site with no difficulty. Then, an administrator runs a security tool (such as the Windows Security Configuration Wizard) and suddenly your Load Tests now fail with HTTP 401 Unauthorized responses.
What happened?
One cause of this can be a feature of NTLM security was enabled, requiring clients to support NTLMv2 “session” security. While this security feature is stronger, it is not universally supported by all clients, including legacy versions of Load Tester.
Getting past the issue is easy: just upgrade Load Tester! Load Tester 5.4 includes up to date support for the stronger NTLM authentication whenever it is required by the server, without requiring any custom configuration.
Note, however, that Windows does use the HTTP 401 error message for a broad number of authentication related issues, in addition to requiring stronger client security. If you are seeing this issue during a replay or Load Test, you should always check to be sure the credentials the test is supplying is valid. If you are using Load Tester 5.3 or earlier, you may also attempt to disable the stronger security by:
- On your server, Use Start -> Run, and open “secpol.msc”
- Navigate to Security Settings -> Local Policies -> Security Options
- In the policy list, look for “Network security: Minimum session security for NTLM SSP (including secure RPC) servers”
- If that policy has the requirement: “Require NTLMv2 session security” checked, uncheck it and press OK.
We hope that this improvement will continue to make testing with Load Tester painless and easy! If you have any questions, please send us message, or post your issue in the support forum, and we’ll be happy to resolve your concerns!
Frank is an engineer for Web Performance. He is also an advocate for correct fire safety procedures whenever applying massive load to production test rigs.