We have a 2000 DC functioning only as the PDC Emulator with an NTLM level of
0 for down level backwards compatibility. We also have 2 2003 DC’s, one of
which holds the 4 other FSMO roles and both are set at NTLM levels of 2,
there default setting. Prior to the 2003 DC's being introduced we would not
get challenged for anything other than logging onto the network and then
everything would get pass through. Now since the 2003 DC's have been
introduced we are getting challenged for credentials everywhere. Does it
matter if the DC's have different NTLM levels? Will the new 2003 DC's try to
override what the 2000 PDC emulator is set to? The reason I ask that
specifically is that recently we had a domain master browser war between the
2000 PDC emulator and the 2003 DC's because they were the newest version of
MS OS on the block. We have a lot of down level clients and this is realy
posing to be a functional problem. Any guidance will be greatly appreciated.
|