A sample deployment of Authentication Policies and Authentication Policy Silos in Active Directory!

Dear Microsoft and Active Directory Friends,

The Active Directory is an important element in an IT infrastructure. With the intensive use, constant expansion, it can happen with time that the overview is lost. What exactly do I mean by this? Imagine you suddenly have 10 backup admins, do you still need them all? If so, are they allowed unrestricted access to all systems? Questions over questions.

In this article I will show you how to use Authentication Policies and Authentication Policy Silos to restrict access for a specific person (domain admin) to a specific system. You don't necessarily need both Authentication Policies and Authentication Policy Silos but the policies and silos go hand in hand in my opinion. Also, multiple policies can be used in one silo. But that would go too far now.

In this example, "Tina Bridge" should no longer have access to the FS01 system. Let's start right away. First of all, I'll show you that Tina can still log on to the FS01 system right now.

Also, on the next print screen, we see that Tina is a member of the domain administrators.

So that would be the current situation.

IMPORTANT: I am absolutely aware that Tina could undo everything (since she is the domain administrator). My point in this example is the principle/function of the Authentication Policies and Authentication Policy Silos, of course everything has to be adapted to the respective situation.

Now let's start with the actual configuration. In order to work with Authentication Policies and Authentication Policy Silos, we need to enable support for this feature. For this we use the group policies to enable the following feature: "KDC support for claims, compound authentication and Kerberos armoring". Since these settings are of a special type, I will use the Default Domain Policy and the Default Domain Controllers Policy.

Please make sure that all systems adopt the new settings of the two GPO's. For example, with "gpupdate /force". Now we need to set up the authentication policy using the Active Directory Administrative Center.

We start with setting up an authentication policy.

It continues with an Authentication Policy Silos. Make sure that you select both the user and computer account in the "Permitted Accounts". In addition, we set this policy to Enforce.

Now we need to assign the Authentication Policy silos at the Tina (user account) and at the FS01 (server system).

We now go back to our Authentication Policy and create a condition. If you want, you can configure the TGT for a specific validity period.

For some reason (couldn't figure it out yet) the "Mode" in our Authentication Policy Silos is reset to "Audit". We need to adjust that again accordingly.

So now let's test the whole thing. At the very beginning of the article, Tina was still able to log on to the FS01 system, how does it look now?

BINGO! Tina can no longer log on to the FS01 system.

This was one of many examples of how you can use Authentication Policies and Authentication Policy Silos. I hope this article was useful. Thank you for taking the time to read the article.

Best regards, Tom Wechsler

P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechsler