Fixes #45763 The recent bump of github.com/Azure/go-ntlmssp to v0.1.1 changed the Negotiator to send an unauthenticated probe before NTLM. NTLM is connection-bound on IIS, and the extra round-trip breaks the handshake on NDES setups behind reverse proxies, Okta Access, or a WAF.