Forum Discussion

mcliviu's avatar
mcliviu
Copper Contributor
Jan 31, 2020

Azure ATP SAM-R

Hi everyone. Context: One of the AATP prerequisites is the SAM-R GPO. https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step8-samr The link above describes how the gpo...
mcliviu's avatar
mcliviu
Copper Contributor
Feb 02, 2020

Or Tsemah 

Hi,

 

My understanding is that on the older versions of OS, everyone has read only access.

However, on the newer versions, and the OS patched in the list below, this GPO is required to allow SAM-R.

Windows 10, version 1607 and later
Windows 10, version 1511 with KB 4103198 installed
Windows 10, version 1507 with KB 4012606 installed
Windows 8.1 with KB 4102219 installed
Windows 7 with KB 4012218 installed
Windows Server 2016
Windows Server 2012 R2 withKB 4012219 installed
Windows Server 2012 with KB 4012220 installed
Windows Server 2008 R2 with KB 4012218 installed

Now, MS recommends to enable the GPO in audit mode first to identify the apps that might require access, in order to avoid breaking things...

 

The issue in my case, is that unlinking the GPO, still doesn't fix OAB, and I think there can be other issues as well.

I was expecting the AATP documentation to be very clear and specific, unfortunately, it's not the case...

In the prod env, SAM-R is built for some accounts, but not for others, therefore the guideline of enabling AATP SAM-R is a bit inconsistent...

 

Or Tsemah's avatar
Or Tsemah
Former Employee
Feb 03, 2020

mcliviu 

Keep in mind that unlinking the GPO does not remove it's associated registry setting defined in https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls#policy-and-registry-names and you have to remove it yourself using group policy preferences or other means (script?).

In regards to the documentation around that requirement, we will take your feedback under advisement.

 

  • mcliviu's avatar
    mcliviu
    Copper Contributor
    Feb 03, 2020

    Or Tsemah 

    Hi,

    In the documentation it says the fix is to unlink the GPO.

    When the GPO is unlinked, the default settings should apply.

    https://support.microsoft.com/en-us/help/4055652/access-checks-fail-because-of-authz-access-denied-error-in-windows-ser

     

    Method 2: Disable the policy

    Clear the RestrictRemoteSAM registry entry or remove the policy.

     

    The documentation states "or", not "and"

     

    If that is applied to thousands of computers, manually removal it's not an option....