Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Working around NPS limitations for AADJ Windows devices-SysManSquad | Systems Management Squad #2

Open
utterances-bot opened this issue Aug 2, 2022 · 43 comments
Open

Working around NPS limitations for AADJ Windows devices-SysManSquad | Systems Management Squad #2

utterances-bot opened this issue Aug 2, 2022 · 43 comments

Comments

@utterances-bot
Copy link

Working around NPS limitations for AADJ Windows devices-SysManSquad | Systems Management Squad

A community blog and subsidiary of WinAdmins.io

https://sysmansquad.com/2021/04/27/working-around-nps-limitations-for-aadj-windows-devices/
@bpubben utterances
Copy link

bpubben commented Aug 2, 2022

Thanks for you workaround, but I'm not quite sure what to fill in at: X509:I>DC=tld,DC=yourdomain,CN=your-CAS>CN=, exspecially at "your-CAS>CN>, can you elaborate?

@Blurn
Copy link

Blurn commented Aug 2, 2022

Hey @bpubben, I think something got truncated when we moved to markdown. I'll fix that in the blog post soon! The path is actually supposed to look like this:

X509:<I>DC=tld,DC=yourdomain,CN=your-CA<S>CN=

The easiest way to find your value is by:

  1. Exporting a certificate from a test machine
  2. Using Active Directory Users & Computers
    1. On a test computer object, right click and choose Name mapping
    2. Under the X.509 tab, click Add and import the certificate you exported
      image
    3. Close out of the name mappings window
    4. Open the attribute editor under the object's properties
    5. Under altSecurityIdentites, you should see a fully derived X509 path that you can use for name mapping
      image
    6. To work with the scripts in the blog post, anything at the end of the string, after CN=, should be removed
      • For example, if the path you got from your test is X509:<I>DC=tld,DC=yourdomain,CN=your-CA<S>CN=mydevice123 you would end up with X509:<I>DC=tld,DC=yourdomain,CN=your-CA<S>CN=

@bpubben utterances
Copy link

bpubben commented Aug 3, 2022

Thnx, that was al to get me back in the right direction.

I've created my dummy object now, with the Azure Device ID, and it containts the correct altSecurityIdentities. Exporting the device certificiate and importing in on my dummy user gave the same result, so that should work.
Connection to my WiFi is resulting in a access denied on my NPS (event ID) 6273 however :-(

On my NPS. Is see the device is using the right network & connection request policy, using the device cert, etc.

EAP Type:			Microsoft: Smart Card or other certificate
Reason Code:			16
Reason:				Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect. Any ideas? Am I missing something on my NPS, its just a plain setup for device authentication with certificates, which i've done many times before, just not with AADJ devices.

@Blurn
Copy link

Blurn commented Aug 3, 2022

@bpubben awesome, always happy to help!

I have a hunch that May 2022's Windows updates may be keeping this from working for you. The first thing I would try is the solution mentioned here.

Basically, you are going to want to add a registry value on your domain controllers to support this type of name mapping (no reboot is needed):

Location: HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel\
Data Type: DWORD
Name: CertificateMappingMethods
Data: 0x1F

Microsoft's deep dive on this is located here. There are some security implications to this change that I haven't had time to investigate. I would read up on this yourself and see if setting that registry value back to 0x1F would have any security issues in your environment.

I'm hoping that helps get your PoC up-and-running. Feel free to reach back out if the above doesn't help.

@benmorris2 utterances
Copy link

We are having the same certificate mapping issue as @Blurn was working before the update. Have applied the reg change but no luck. Devices are authing against a 2012r2 RODC.

@bpubben
Copy link

bpubben commented Aug 16, 2022

For me the reg change helped, applied on a 2019 DC which is also NPS

@rpertusio utterances
Copy link

@Blurn, the problem with the workaround is that it has a timebomb, per the KB:

"we will update all devices to Full Enforcement mode by May 9, 2023. If a certificate cannot be strongly mapped, authentication will be denied."

In other words, this workaround will stop working!

@PetriAsi utterances
Copy link

altSecurityIdentities can be strongly mapped, so it this can work after May 9, 2023.
If mapping is using certificate serial (SR), sha value (SHA1-PUKEY) , or (SKI) value.

I'm running little script for macos computers from intune. They are joining domain and got PKCS certs with intune configuration profiles.

Script is monitoring C:\Program Files\Microsoft Intune\PFXCertificateConnector\PfxRequest\Succeed folder. After new cert is issued script look for macos computer account in AD, adding altSecurityIdentities to computer object for strong cert mapping. So far all is good, After this Kerberos server is then accepting certificate and I can see successful logon on DCs security log, when macos is trying to authenticate to wifi via nps.

But NPS is still rejecting login with event ID 6273, reason 8 (The specified user account does not exist.) It's really strange as kerberos ticket is granted.

My macos certificates are using following attributes: CN=computername.local.domain and SAN DNS=computername.local.domain they seems to satisfy kerberos server but NPS is still doing some check that fails.
Any ideas what attributes could be missing from my certs?

@PetriAsi utterances
Copy link

Got it working also with macos and now answering my own question:

On PKCS policy I have to change certificate common name to DistinguishedName like CN={{DeviceName}},OU=Devices,DC=domain,DC=local that match computer object created when macos is joining domain. And also add two subject alternative names DNS: CN={{DeviceName}}.domain.local and in UPN: {{DeviceName}}$.domain.local

After that NPS started to find user accounts also for macos devices. There's also AltSecurityIdentities attribute on computer object that maps to certificate with certificate serial number.

@RaphaelEymann utterances
Copy link

For me it is working with the registry key CertificateMappingMethods set to 0x15. But I manually configure the mapping with X509IssuerSerialNumber I still receive "user credential mismatch". I found some posts that this is only working for user accounts and not for computer accounts. Any ideas?

@PetriAsi
Copy link

PetriAsi commented Sep 9, 2022

@oSLiD3Ro We are mapping macos device certs to computer accounts with serial number. To make it work we had to set certificate CN to full DistinguishedName of computer object and also added two subject alternative names DNS: CN={{DeviceName}}.domain.local and in UPN: {{DeviceName}}$.domain.local

@andershannus utterances
Copy link

The may 2022 update breaks this script.
There is a regkey that can be added to enable April 2022 functionality but that would be a temporary solution.
https://learn.microsoft.com/en-us/answers/questions/846654/nps-stopped-working-after-may-2022-updates.html

I was successfull by using this altSecurityIdentities
X509:c934eca7f41c8....

There is a powershell module: Install-Module -Name PKITools
Buy using that one you can get all certificates for the device ID and then select the most recent one and use the SubjectKeyIdentifier and also update that if changed. More complex solution but it will work.

@andershannus utterances
Copy link

I also tried X509IssuerSerialNumber but that would not work. But the X509SKI did.

altSecurityIdentities = X509:c934eca7bbbbbbbbbbbb
the was missing in my earlier post.

https://support.microsoft.com/en-gb/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16

X509SHA1PublicKey might also work but SKI seems like a good candidate.

I also need to get all shared iPads from Intune besides Autopilot devices so I need to rework the example script quite a bit to get all targeted I need.

@Blurn
Copy link

Blurn commented Sep 21, 2022

To get the article up-to-date and provide accurate information to anyone looking at this the first time, I'm planning on updating the post sometime soon to mention the May updates.

(@andershannus that is a super cool solution for mapping issue. I will look into working that into the script. Full credit to you for working through that.)

@saqib-s utterances
Copy link

saqib-s commented Oct 21, 2022

Looking forward to an updated script, I'm in the process of trying to get this working with the registry key method.

@RaphaelEymann utterances
Copy link

@andershannus
I think you have altSecurityIdentities = X509:123456789abcdef and not altSecurityIdentities = X509:123456789abcdef or I am wrong? Did you have to reserve the SKI string like the serial number or just remove the spaces and than add that string?

@andershannus
Copy link

andershannus commented Oct 28, 2022 via email

@saqib-s utterances
Copy link

saqib-s commented Oct 28, 2022 •
edited
Loading

been struggling to get this working, I've got the certificates issuing to my devices via NDES without issue, and the objects created but hitting NPS error of "Authentication failed due to a user credentials mismatch.", I've applied the registry key to the domain controller that is acting as the NPS server and it's still not working, I've tried setting "CertificateMappingMethods" reg key to 0x1f and 0x1 and 0x15 and no joy, same error, I've also applied the other regkeys mentioned in the MS article. "StrongCertificateBindingEnforcement"=dword:00000000
"CertificateBackdatingCompensation"=dword:01e13380

Still get the same error, I've also tried to manually replace altSecurityIdentities to show the client's certificate SKI (from the certificate) still not match.

Any advice would be helpful, do they regkeys need to be applied to ALL domain controllers?

@andershannus
Copy link

andershannus commented Oct 28, 2022 via email

@saqib-s
Copy link

saqib-s commented Oct 28, 2022

thanks... the image is not visible

@andershannus
Copy link

andershannus commented Oct 28, 2022 via email

@skaggake
Copy link

skaggake commented Nov 3, 2022

The SKI string is not reversed. Serial number weds to be that but I did not try that or see any advantage in choosing that. I have a working solution but have not decided how often it needs to run. I’m trying with every 15 min for now. This is absolutely a drawback of the strong bind that you can’t populate this before the certificate is generated.

Can you share your solution? I have successfully authenticated with X509IssuerSerialNumber but i have done the certificate mapping manually. How can we automate this with Serialnumber, SKI or SHA1PublicKey?

@saqib-s utterances
Copy link

saqib-s commented Nov 7, 2022

Minor update - after applying all three registry keys as below, to ALL domain controllers my device authenticated. Which is a relief, I was trying to apply these keys to just the domain controller that NPS was installed on (which it turns out was a RODC), as soon as I applied a GPO to set these keys my device authenticated (with the CN binding as in this script).

Looking forward to any further discussion you all have around the following:

  1. Using SKI binding in a script and how to over come the object date / cert date conundrum
  2. Process to move to secure binding without risking affecting current users

Welcome any thoughts / ideas.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
Value -CertificateBackdatingCompensation
Data Type -REG_DWORD
Data - 10 years: 0x12CC0300

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
Value - CertificateMappingMethods
Data Type -DWORD
Data -0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
Value- StrongCertificateBindingEnforcement
Data Tpe - REG_DWORD
Data - 0

@tcppapi utterances
Copy link

tcppapi commented Nov 24, 2022

Updated solution here:
https://www.reddit.com/r/Intune/comments/z2lnbn/how_to_aadjintunebased_certificate_authentication/

@saqib-s utterances
Copy link

saqib-s commented Dec 14, 2022 •
edited
Loading

I've pulled together the hash synching from tcppapi's script and bolted it onto Andrew's script (commented out the weak attribute creation), this script does the objects synch from Azure AD Autopilot devices to AD and then adds the certificates thumbprint (format below) to altSecurityIdentities.

“X509:<SHA1-PUKEY>123456789abcdef”

I've tested this and it works with clients authenticating.

Note:

  1. You must have UPN to SAN Mapping disabled for this to work (https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/disable-subject-alternative-name-upn-mapping)
  2. You must have the SAN UPN attribute in the certificate be in the format: host/{{AAD_Device_ID}}

See my script here..

https://github.com/saqib-s/AADJ-DummyObjects-Sync-x509

@saqib-s utterances
Copy link

saqib-s commented Dec 15, 2022

One more caveat / - RODCs (Read-Only Domain Controllers) - when our NPS uses a RODC for user lookup etc , then secure binding errors out with the "user credentials mismatch" error, when using a NPS that is connected to a regular domain controller then user lookup with secure binding works with no issue.

@KevinLauer utterances
Copy link

I tried to implement your solution @saqib-s in our environment. As expected it worked as soon as i disabled UPN to SPN Mapping on our DCs. Thanks for the updated script!

The Problem is that disabling UPN to SPN Mapping breaks smartcard authentication (2FA for various Admin Accounts) and user authentication to the NPS server. (We use user certificates to authenticate our Smartphones to Wifi)
We could now match every user and smartcard certificate explicitly with strong mappings, but that does not sound like the best solution either.

I don't quite understand why UPN to SPN Mapping is necessary for the strong certificate mapping to work (but it clearly is).
My understanding was that implicit mapping is checked first by SCHANNEL and if there are no matches it checks for explicit mappings. Unfortunately that does not seem to be the case here.

Do you have an idea how we could solve this issue to get all solutions working together?

@saqib-s
Copy link

saqib-s commented Jan 5, 2023

@KevinLauer glad to hear you found it useful, I can't help you directly with the issue with smart card authentication breaking with the UPN to SAN disable in effect.

There does seem to a either/or scenario with implicit / explicit mappings.

https://www.serverbrain.org/certificate-security-2003/defining-the-mapping-in-active-directory.html
"Important Explicit mappings cannot be used for smart card logon. Smart card logon only uses an implicit mapping by mapping the UPN in the Subject Alternative Name of the certificate to the UPN of a user account in Active Directory. Explicit mappings can be used for Web authentication, wireless authentication, and VPN authentication."

@andershannus
Copy link

andershannus commented Feb 15, 2023 via email

@mtengmo utterances
Copy link

mtengmo commented Mar 21, 2023

Will it also work for MacOS devices onboarded to Intune?
When do you think you got a PoC of the TameMyCerts ?

@jnickell utterances
Copy link

jnickell commented Jun 9, 2023

I found this as I was feeling out our transition from solely on-prem to AADJ of some fashion. @Blurn, wondering if you'd had a chance to make the updates?

I'm trying to go the route mentioned by @andershannus (absent knowing what/if configuration changes are needed with the TameMyCerts module.

Unfortunately I picked the day to work on this that the azure portal is down. So until I can pick that back up, has anyone got the whole thing working and avoided the timebomb that has been mentioned?

I'm hopeful that by using this approach I can accomplish two things Wifi and Secure DNS updates performed by the clients. Our DHCP servers are not AD integrated and an internal application needs to be able to lookup clients via DNS.

@svdbrom utterances
Copy link

svdbrom commented Sep 12, 2023

Hi Andrew,

2023-03-11
"I am currently working on a new blog post that includes major improvements to the Sync-DummyComputers.ps1 script and also outlines the TameMyCerts configuration. Stay tuned for the link!"

Any progress with the new blog that also outlines the TameMyCerts configuration?
Just curious :-)

@Martony78 utterances
Copy link

Hi guys!
I talked to Per Larsen (Intune PM) last week at the Paris MEM Summit 2023, the more evidence we can get, the more chance we have to force MS to move on this.

"I talked to our feature PM about NPS and getting AAD/Intune device support.
We are going over the customer evidence again - we do not have enough customers evidence, so if you have more information and more customer evidence you can share.
Customer name, size and use case.
Thanks Per"

Please send it to [email protected]

#IWork4Dell

@Blurn
Copy link

Blurn commented Oct 2, 2023 •
edited
Loading

Sorry for the radio silence on my end. I was on parental leave and was trying to be as "offline" as possible. I will look at updating the post, or making a follow-up post, ASAP. I still need to do some more testing, but this seems feasible in conjunction with https://github.com/PKISolutions/ADCS-SID-Extension-Policy-Module (TameMyCerts hasn't been updated to include the new extension type).

@Martony78 I will email a use case soon.

Thanks and sorry again.

@saqib-s
Copy link

saqib-s commented Oct 2, 2023

Congratulations Andrew on becoming a parent, I'm sure time is hard to find. Looking forward to an updated post, I'm curious how using the new extension type would work for AADJ devices, as I understand that the CA ties the cert to the AD object's SID, so I assume the AD object would have to be created first, then the cert issued? If building a new device, would the SCEP req for a new cert error out until an object is created?

@andershannus utterances
Copy link

Autopilot devices will create an Entra ID device object right away so an AD computer object should be created before the computer tries to get a certificate but that still demands that the script is run pretty often. I have actually not tried the TameMyScritp solutions as it works good at get and add the SKI from the certificates to the computer objects.

But I'm trying right now to make the same solution work with shared iPads but am struggling with NPS finding the dummy computer object. Might be the certificate or it might be something else. NPS reads the correct device name from the certificate but perhaps it's only looking for DeviceUI$ as SamAccountName and that will obviously not work. Will update if I find a solution för iPads.

@andershannus
Copy link

I modified my Autopilot solution, based on this script, to work with iPads without user affinity. I could never get the NPS to match the certificate to the corresponding computer object in the same way that works just fine with Windows Autopilot computers. I modified the certificate template in Intune to also include UserPrincipalName in the form of {{AzureADDeviceId}}@addomain.com and modified all iPad computer accounts to have the same UserPrincipalName. With that modification, NPS now finds the computer accounts, and the login works. Read somewhere that it was needed for macOS so that is why I tried this. I have not tried to remove DNS from the SAN in the certificate nor remove the SPN on the computer account but I don't think it's needed. I use SKI for altSecurityIdentities as that is easy to work with.

@CuriousTB utterances
Copy link

@andershannus Thanks for sharing your insights on this one. CA and MDM newbie here, would be awesome to know how you got your iPads without user affinity to work. I'm trying to achieve the same for macOS and struggling to figure a solution (same as most cases in this thread - macOS device affinity, Intune managed and AAD joined, NPS and NDES on-premises). Some granular info as to how you did it would be at great help for many like me for sure !!

Thank you !

@RWallis01 utterances
Copy link

I seem to be stuck on the Radius Auth I am using the same rules for on premise although created a pathway for AAD devices using a regex to recognise the naming. We are using computer authorisation as the user will be checked by global protect after login.

NPS recognises the device
User:
Security ID: EMPIRE\0e48f9aa-254c-4$
Account Name: host/0e48f9aa-254c-44f8-8b6b-1bf9fd20b181
Account Domain: EMPIRE
Fully Qualified Account Name: EMPIRE\0e48f9aa-254c-4$

The error is
Reason Code: 300
Reason: No credentials are available in the security package

The connection rule has certificate and PEAP authentication enabled

The Wi-Fi profile is being pushed out by intune however this is the first time we have done it this way normally it is done via GPO. Any tips on where the issue might be?

Thanks

Rob

@RWallis01 utterances
Copy link

So I added Certificate / SmartCard into the PEAP properties on the connection request(it was already listed separately outside of PEAP). I am now getting error 16 authentication failed...mismatch. I've tried saqib's script and still the same.

Our device cert has subject CN={{AAD_Device_ID}} and UPN=host/{{AAD_Device_ID}}

I've made the following modifications to both scripts removing Get-Object here as it fails otherwise

Pull latest Autopilot device information

$AutopilotDevices = Get-AutopilotDevice

and also on Saqibs script 2 changes. Removed .host otherwise there is a casting error.
foreach($CAHost in (Get-CertificationAuthority)){

and also added a filter due to the amount of certificates our CA has issued!!
$IssuedRaw = Get-IssuedRequest -CertificationAuthority $CAHost -Property RequestID,ConfigString,CommonName,CertificateHash,RawCertificate -Filter "CertificateTemplate -eq Azure Workstation"

Hopefully it is something simple?

Thanks

Rob

@RWallis01 utterances
Copy link

Got it working unsure which fix it was but did the 3 reg keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
Value -CertificateBackdatingCompensation
Data Type -REG_DWORD
Data - 10 years: 0x12CC0300

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
Value - CertificateMappingMethods
Data Type -DWORD
Data -0x1f

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
Value- StrongCertificateBindingEnforcement
Data Tpe - REG_DWORD
Data - 0

and the SAN mapping key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\UseSubjectAltName

thanks all

@saqib-s
Copy link

saqib-s commented Mar 18, 2024

@RWallis01

I would not go into production with "StrongCertificateBindingEnforcement" set to 0, Which disables the strong certificate mapping check. This is not recommended because this will disable all security enhancements.

Note this from Microsoft:
Unless updated to this mode earlier, we will update all devices to Full Enforcement mode by February 11, 2025, or later. If a certificate cannot be strongly mapped, authentication will be denied.
https://support.microsoft.com/en-gb/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16

You should be building your solution to work with secure certificate binding.

@RWallis01 utterances
Copy link

Never made production however gone to try this again with views to work towards production and again the devices won't connect

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:
Security ID: EMPIRE\xxxxxxxxx-f7cd-4$
Account Name: host/xxxxxxxx-f7cd-4652-813e-d6d45ddf63d8
Account Domain: EMPIRE
Fully Qualified Account Name: EMPIRE\7f9c851e-f7cd-4$

Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
Called Station Identifier: xx-xx-xxx-xx5:eduroam
Calling Station Identifier: xx-xx-xx-xx-xx

NAS:
NAS IPv4 Address: 172.16.49.150
NAS IPv6 Address: -
NAS Identifier: IT OFFICE
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 0

RADIUS Client:
Client Friendly Name: IT OFFICE
Client IP Address: 172.16.49.150

Authentication Details:
Connection Request Policy Name: authenticate azure joined computers
Network Policy Name: -
Authentication Provider: Windows
Authentication Server: xxxxxxxx.xx.x.x.x.x
Authentication Type: PEAP
EAP Type: Microsoft: Smart Card or other certificate
Account Session Identifier: 42384241423946344139333243384446
Logging Results: Accounting information was written to the local log file.
Reason Code: 16
Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

This is with the 4 keys mentioned above. The host has a certificate issued from internal cert services. The host has been synced AD. There is an altSecurityIdentities entry

Unsure where else to look!!! Really want to move our shared on premise laptops to autopilot but this is proving to be a blocker! I don't want to have to create a separate ssid and definitely don't want a passworded one!

Thanks,

Robbie

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests