| Previous | Next |
| SEC_E_DELEGATION_POLICY | SEC_E_NO_CONTEXT |
SEC_E_POLICY_NLTM_ONLY
SEC_E_POLICY_NLTM_ONLY identifies a failure in CredSSP delegation without verified server identity. The client would have to delegate credentials after NTLM-only authentication, and policy does not permit delegation without stronger server authentication. Diagnose CredSSP delegation without verified server identity at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Start with the returning API
Credential delegation is a policy decision made after identifying the target and authentication method in a CredSSP delegation without verified server identity investigation. Capture the transport scheme, target name, server-authentication result, selected package, and applicable CredSSP policy entries. A valid user password does not override a rule that forbids sending reusable credentials.
Diagnostic evidence matrix
- Target name and transport scheme as evaluated by the client
Confirm whether Kerberos failed because of an SPN, DNS name, clock, trust, or account problem.
In the path, pINs the result to a specific handshake or KDC decision. - Selected authentication package and whether server identity was verified
Inspect the NTLM-only CredSSP policy separately from the normal fresh-credentials policy.
Separates identity proof from delegation or transport policy. - Effective credential-delegation policy and matching target pattern
Prefer restoring Kerberos/mutual authentication rather than broadly permitting NTLM-only delegation.
Keeps target names, package selection, and context state comparable.
Build a timeline before changing state
Authentication failures are multi-leg transactions. Align client SSPI calls, DNS and target-name resolution, policy refresh, domain-controller or KDC events, ticket acquisition, server acceptance, and any proxy or TLS transition., a single application timestamp is not enough to tell whether the decision was local policy, peer identity, context state, or KDC behavior.
- Package and target name, requested and returned context attributes, and each SSPI return in order.
- In the path, relevant Group Policy result, SPN or UPN resolution, contacted DC/KDC, and ticket or certificate identities.
- One permitted control target and one deliberately rejected target evaluated with the same client build in a CredSSP delegation without verified server identity investigation.
Minimal test sequence
Compare the failing target with a deliberately permitted test target under the same policy, then compare Kerberos or certificate-authenticated identity with an NTLM-only path., do not modify several Group Policy rules at once.
- Preserve the original input, identity, provider or protocol selection, and first return Value.
- Use one known-good control that changes only the suspected part of the CredSSP delegation without verified server identity path.
- reverse the comparison with known-good input on the failing layer where that can be done safely.
- Record where behavior first diverges in the CredSSP delegation without verified server identity path instead of judging only by the final application message.
Boundaries of this HRESULT
SEC_E_DELEGATION_POLICY is the general policy denial; this result specifically exposes the NTLM-only authentication condition., adding a broad wildcard to make delegation succeed can expose credentials to unintended servers. Use the narrowest target rule and prove the server identity path first in a CredSSP delegation without verified server identity investigation.
For CredSSP delegation without verified server identity, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
Closure criteria
In the path, the client should delegate only to the intended authenticated target and continue to reject an unlisted or insufficiently authenticated control target. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant CredSSP delegation without verified server identity interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: CredSSP Group Policy Settings.
- Microsoft Open Specifications: CredSSP Protocol.
Looking for a different code? Search another status or error code.