Blog Post

Core Infrastructure and Security Blog
9 MIN READ

Protecting Tier 0 the Modern Way

DagmarHeidecker's avatar
DagmarHeidecker
Icon for Microsoft rankMicrosoft
Feb 19, 2024
How should your Tier 0 Protection look like?   Almost every attack on Active Directory you hear about today – no matter if ransomware is involved or not – (ab)uses credential theft techniq...
Updated Feb 19, 2024
Version 5.0
DagmarHeidecker
ckuever0983's avatar
ckuever0983
Copper Contributor
May 06, 2024

Hi,

implemented the modern way in a test environment, meaning PAW (cloud native) and the AVD hostpool dmoin joined. Auth policy and so on created via the Powershell Script Toolkit. All seems to be fine but whenever the policy is enforced we get:

A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.

tier 0 systems are targeted correctly, policy is applied to the tier 0 admin accounts. 
Kerberos armoring is activated via gpo for the DCs and clienst/member servers, we see via wireshark also the incoming kerberos requests (so no firewall issue as well)

Anyone else have the same problem? Currently totally confusing as we checked everything multiple times and can't find any misconfiguration. 

Servers are freshly installed Server 2022.

 

Thank you for any suggestions