Hello All, Does anyone have experience with a problem in what appears to invovle a load balancer, Squid, and NTLM where the browsers always prompt for username & password and solved it already? What kind of problems could there be when the only way to fix the browser always prompting for username & password is removal of the profile's ntuser.dat file? I have three squid servers on Gentoo Linux configured as the Internet Proxy for approximately 2500 consumers with automatic negotiation via NTLM. The client browsers are configured to point to an HA address that transparently load shares between the three servers. The NTLM helpers are configured, winbindd is running, samba works in the Active Directory domain. This works for most of the consumers all the time, it's a beautiful thing with one imperfection at the moment; there have been about 80 occurrences when the automatic authentication in NTLM breaks down in the profile that causes Internet Explorer to prompt for the username & password. For /whatever/ reason in these profiles the automatic authentication breaks down forcing the username & password prompt to display for some of the profiles with every new instantiation of Internet Explorer. This /whatever/ is in the Windows profile, if someone else uses the same computer but uses a different account the automatic authentication works fine for that account. The only way I've found to fix this problem where the prompt always appears for the first get on the Internet is to delete the ntuser.dat file. In limited tests, Firefox appears to work when that's been available, but most people do not install Firefox. The number of clients where this happens also increases given problems within the network. We had a DNS outage and these break down events happened all over the place. Besides removing the ntuser.dat file, there's another way I've found to fix the case where the prompts show all the time. That is to point the client to one of the three squid servers and not go through the HA address on the load balancer. Mike .
