Forum Discussion
Azure ATP remote calls to SAM blocked RDS connection
I recently deployed Azure ATP to a enveriement running Windows 2012 R2 and older machines. During the configuration Azure ATP service account was added to Network access - Restrict clients allowed to make remote calls to SAM and pushed out to all machines via default domain policy as required for https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step8-samr detection.
Shortly after this change users were denied access through RDS, domain admins were still able to use RDS. As a workaround selected users were added to the Network access - Restrict clients allowed to make remote calls to SAM policy to restore service.
I've done some research and did not come across any article around configuration conflicts between the remote calls to SAM policy and RDS service. One https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/troubleshoot/cannot-authenticate-or-must-authenticate-twice#access-denied-a-remote-call-to-the-sam-database-has-been-denied I was able to find talks about changes to RDS in Windows Server 2016, where RCM no longer queries the user's object in AD DS which may or may not be related.
Had anyone came across this issue? Anyone have a better understanding of RDS, how SAM-RPC is used, and what the recommended configuration is.
3 Replies
Hi, yes, this particular GPO setting needs to be tested first before configuring it and we do mention it in our docs as it might need special configurations for applications such as RDS or Citrix for that matter
See: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
Or Tsemah Thank you for your reply. I am aware of this article and the audit mode, however neither this or any other I've read had any direct mention of RDS incompatibility with this policy.
Seeing how RDS is a Microsoft product are there any article with recommended/best practice configuration to work with this policy, where we would not need to add all users to this policy to keep RDS working.
ehloworldio I understand what you mean
You can see other products such as exchange publish support documentation regarding this group policy for example (https://support.microsoft.com/en-us/help/4055652/access-checks-fail-because-of-authz-access-denied-error-in-windows-ser), while this doesn't answer your question, i hope that it at least make it a bit more clear to why there are caveats with this policy.
