Forum Discussion
Cloud Kerberos - Failed to read secrets from the domain
Hi all,
Apologies if this is the wrong place to post this!
I am looking at understanding Cloud Kerberos and the uses behind it, primarily for WHfB for now. Following the guide on the Microsoft page, I get an error when running on the DC
Passwordless security key sign-in to on-premises resources - Microsoft Entra ID | Microsoft Learn
Set-AzureADKerberosServer : Failed to read secrets from the domain DOMAIN.LOCAL.
The lab environment has 2 DCs at different sites but replicate between each other without issue.
The process creates an entry in AD but when I run the command below (GA details is an address, just changed for the forum post)
Get-AzureADKerberosServer -Domain $domain -UserPrincipalName "GA details" -DomainCredential $domainCred
I get the output below...
Id : 16451
UserAccount : CN=krbtgt_AzureAD,CN=Users,DC=DOMAIN,DC=LOCAL
ComputerAccount : CN=AzureADKerberos,OU=Domain Controllers,DC=DOMAIN,DC=LOCAL
DisplayName : krbtgt_16451
DomainDnsName : DOMAIN.LOCAL
KeyVersion : 1598799
KeyUpdatedOn : 27/07/2024 06:41:15
KeyUpdatedFrom : PDC.DOMAIN.LOCAL
CloudDisplayName :
CloudDomainDnsName :
CloudId :
CloudKeyVersion :
CloudKeyUpdatedOn :
CloudTrustDisplay :
Can you advise why the secrets aren't being found and the cloud information not populated?
This is a lab enviroment so if needed, we can get a bit rough with it.
Any help would be welcomed.
Kind regards
Tom
I ran the Set-AzureADKerberosServer from my laptop with the latest AzureADHybridAuthenticationManagement module installed with GA and DA accounts. Likewise it failed with message "Set-AzureADKerberosServer: Failed to read secrets from domain..."
The Get-AzureADKerberosServer command then only showed the values for the top half of the listed parameters, the "cloudxxxx" ones in the bottom half of the list being blank.
The AzureADKerberos computer object had been created, but obviously something was wrong...
I backed out and cleaned up with Remove-AzureADKerberosServer which removed the computer object.
After seeing this post, I tried running the powershell on our AD Connect server. This worked seamlessly!
It seems that C:\Program Files\Microsoft Azure Active Directory Connect\AzureADKerberos\AzureAdKerberos.psd1 on an AD Connect server is needed.
Be handy if this was mentioned in the MS instructions: Passwordless security key sign-in to on-premises resources - Microsoft Entra ID | Microsoft Learn
- I had the exact same experience, except I did not have to remove the existing object. Once I ran the commands from the AD Connect server, and did not receive the "failed to read secrets..." error, Kerberos auth started to work.
It does seem like there's more needed than just an "import-module AzureADHybridAuthenticationManagement", which did not error on my laptop, it just didn't work.+1
I had the same "failed to read secrets from the domain" error when I installed the module and ran PS as an admin, while logged on as a domain admin, on the domain controller for the sole domain in our environment. When I tried from the AAD Connect server, it seems to have run without issues.
- Hi. Could you please share the complete set of command lines you use in the creation process?
Also, what version of Windows Server and Domain/Forest levels are you running?
Also just to confirm, you are running Entra Connect Sync from on-premise AD to Entra ID? Twrriglesworth I got my problem fixed the following way
Had to run the commands from the AD Connect server (the module uses ADconnect dll's).
Also had to run the command import-module .\AzureAdKerberos.psd1 from the directory where the module is installed (under programfiles)
Set the $cloudcred and $domaincred in variables then the command worked.
/Joachim
- Glad you got it working, but it is not required to run from server where Entra Connect is installed.
However it is required to install the module. Microsoft learn article states: "Install the AzureADHybridAuthenticationManagement module". That works well the times I have setup cloud kerberos trust.
I agree with you that it can be necessary to run command "import-module .\AzureAdKerberos.psd1" if command "import-module AzureADHybridAuthenticationManagement" does not work.
In my case the Kerberos domain object had all attributes other than CloudTrustDisplay, which was blank. When running Set-AzureAdKerberosServer, I also got the error 'Cloud Kerberos - Failed to read secrets from the domain'. The issue was that I was not running the script from an Azure AD joined machine. Hope this helps someone.
