LocalSystem NTLM Proxy Login with the Computer Account
Check the network identity presented by a Windows service rather than assuming it uses the desktop user’s proxy account.
A browser login that succeeds for the person at the desktop does not establish the identity of a LocalSystem service. LocalSystem is associated with the computer and is not the logged-on user.
When the application uses the Windows security context for proxy authentication, inspect which account the proxy actually receives. On a domain-joined machine this can be the computer account, rather than the employee’s account.
Windows has a specific policy named Network security: Allow Local System to use computer identity for NTLM. It controls LocalSystem services using Negotiate when they fall back to NTLM. The supported policy and its default differ across historical Windows versions.
The HTTP client must also use a supported proxy authentication path and request the intended credentials. The policy alone does not add authentication support to an arbitrary client.
Compare the service’s configured account, negotiated authentication method and proxy authorization record before changing policy. Granting an employee access does not automatically grant the computer account the same access.