When using NTLM authentication to AD FS 2.0, from Google Chrome or Firefox 3.5+ running on Windows, then this results in a repeated sign-in dialog and finally sign-in failure, with 'Audit Failure' events with "Status: 0xc000035b".

This can be 'solved' by switching off 'Extended Protection' for the "/adfs/ls" web application in IIS. This is documented in several places; see [my answer to another StackOverflow question](https://stackoverflow.com/questions/5436441/adfs-authentication-ie8-works-chrome-fails/5437077#5437077) for details.

My question is: How can one make NTLM authentication to AD FS work for these browsers *without* switching off 'Extended Protection'? I mean, in Internet Explorer this works fine with 'Extended Protection' on, why don't Chrome or Firefox? Or is this a Chrome/Firefox implementation bug/restriction, e.g., in their use of the Windows NTLM library?

*Update:* I should have mentioned that I'd like to do this without forcing people to make changes in their browser settings.