[Solved] How do I properly add a wildcard domain to Edge tracking prevention exception list?
Found the solution, which was there in front of my eyes all this time but I didn't pay enough attention. Edge shows the correct syntax [*.]example.com so entering [*.]live.com is acceptable and fixes the issue! lesson learned: always pay attention to the info on the screen.Passwordless RDP Authentication for On-Prem Servers with Smart Cards (FIDO2 Security Key)
Hello Everyone, in my previous blog, I discussed how to use FIDO2 Security Key Passwordless Authentication with Entra or Hybrid Joined devices for Remote Desktop Connection. In this blog, we will discuss how a FIDO2 Security Key can be used as a smart card for Remote Desktop Connection Protocol on on-prem Active Directory domain-joined servers. If you have not gone through my last article, you can click here. Many people have written several articles and blogs on similar topics, so I apologize if you find it duplicate. Recently, a customer asked me whether it was possible to authenticate using a FIDO2 security key to connect to a remote on-prem domain joined server via RDP. I successfully enabled it for them and decided to write a blog on the topic. This is a great use case for administrators who frequently use high-privileged groups like Domain Admins and Enterprise Admins, as they should adopt passwordless authentication for secure day-to-day server management using smart card-based authentication. Basically, what I will be demonstrating here is Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), which is an extension of the Kerberos Authentication protocol that allows users to authenticate using certificates. There are some vendors who facilitate PIV (Personal Identification Verification) in security keys for strong authentication. With PIV, we can use the security key to store certificates for authentication. So, let’s discuss how we can use this feature to go passwordless by accessing the remote desktop of servers. First of all, we need a PKI infrastructure or a Certificate Server, which we can deploy on Windows Server by adding the Certificate Services role or using an existing one. Once we have a certificate server, we can configure the certificate templates for users and domain controllers. In order to use RDP for servers, both the client and domain controller (DC) need to have a valid certificate as they use mutual authentication. We can issue a “User or Smart Card Logon” certificate to users and a “Kerberos Authentication” certificate to DCs. Before we get into settings and configuration, let’s understand how Kerberos PKINIT works at a high level, which will further help us understand the entire process of this activity. Kerberos Public Key Cryptography for Initial Authentication (PKINIT) in the Kerberos protocol enables the use of public key cryptography in the initial authentication exchange. It uses X.509 certificates (Smart Card) in place of a password to authenticate against the authentication server. The key components involved here are: The Domain Client running Windows 10/11, who wants to access a remote server over RDP. The Domain Controller (KDC) running on at least Windows Server 2016, which authenticates users in Active Directory. The Domain Member Server running on at least Windows Server 2016, which is the target system the client wants to connect to. A Certificate Authority (CA) running on at least Windows Server 2016, which issues Kerberos Authentication and User or Smart Card Logon certificates. Authentication Flow: The Client selects a smart card during authentication, which sends an AS-REQ (Authentication Service Request) to the Domain Controller (KDC) containing the user’s X.509 certificate. It essentially signs the current time with its private key. The Domain Controller validates the request by checking the times using the user’s public key. Once the Domain Controller completes the validation, it issues a TGT (Ticket Granting Ticket) signed by the KDC certificate using its private key as an AS-REP (Authentication Service Reply) response. The Client validates the TGT by verifying the KDC’s certificate. Once the Client has the TGT, it can proceed to request a service ticket to connect to the target server. It is important to note that if we have an Enterprise or AD-integrated Certificate Authority, the Root CA or Issuing CA's certificate will be automatically added to the Trusted Root Certification Authorities store in domain-joined systems. In case we use a standalone CA, we must manually add its certificate to the client machine’s Trusted Root Certification Authorities store. Now, let’s go through the whole process step by step. We will first start by creating a template for the Domain Controller (DC) certificate and later for User certificates. We will also see how to configure Group Policy for certificate auto-enrollment to issue certificates to users and DCs. Issue Kerberos Authentication Certificate to Domain Controller: Go to the Certificate Server and open the Certificate Authority console. Click on Templates and then click on Manage. The Domain Controller (DC) requires the KDC Authentication certificate (1.3.6.1.5.2.3.5) EKU and Server Authentication (1.3.6.1.5.5.7.3.1) EKU. Select the Kerberos Authentication template. Select the Kerberos Authentication template and create a duplicate template. Next, do not make any changes to the certificate template except for assigning a name under the General tab. Go to the Security tab and ensure that only the Domain Controllers group is added with Read, Enroll, and Autoenroll permissions selected. Under the Subject Name tab, ensure the DNS checkbox is selected. Next, we need to issue the Kerberos Authentication certificate template to make it available for Domain Controllers (DCs) to request certificates. Group Policy Configuration: Next, we need to create a Group Policy for certificate auto-enrollment and link it to the Domain Controllers OU. Open the GPO and go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies. Edit Certificate Service Client – Auto Enrollment Properties and select Renew Expired Certificate and update Certificate options as shown in picture below. Go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies and set "Certificate Services Client – Certificate Enrollment Policy" to Enabled. We also need to create another Group Policy Object (GPO) and link it to the domain to enable additional policies for the Client & Server to accept smart card authentication for RDP connections. This policy will determine how the system should behave when the smart card is removed. In this case, it will be set to disconnect the session. Go to Computer Configuration\Windows Settings\Security Settings\Security Options and enable "Define this policy setting" and select option "Disconnect if a Remote Desktop Services Session" Next, we will enable the use of smart cards by setting the policy "Allow ECC certificates to be used for logon and authentication" under: Computer Configuration\Administrative Templates\Windows Components\Smart Card Create Smart Card Logon Certificate Template for Client: Now, go back to the Certificate Server, open the Certificate Authority console, and open the Manage console by right-clicking on Certificate Templates. Select the Smart Card Logon template, right-click, and choose Duplicate Template. Under the Compatibility tab, set: Certificate Authority to Windows Server 2016 Certificate Recipients to Windows 10/Windows Server 2016 Next, go to the General tab and assign a name of your choice. This is the same certificate that the user will see when they issue a smart card certificate to be stored in the FIDO2 Security Key. Go to the Request Handling tab and: Under Purpose, select "Include symmetric algorithms allowed by the subject." Enable "For automatic renewal of smart card certificates, use existing key if a new key cannot be created." To ensure the certificate is saved in the FIDO2 Security Key during the request, select "Prompt the user during enrollment and require user input when the private key is used." Note: I tested the "Prompt the user during enrollment" option, but it did not work. Next, go to the Cryptography tab and: Under Provider Category, select "Key Storage Provider." In Algorithm Name, choose "ECDH_P384" (assuming you meant P384, as P383 is not a standard option). Under Cryptographic Provider, select "Request must be one of the following providers" and choose "Microsoft Smart Card Key Storage Provider." Change Request Hash to "SHA256." Next, go to the Security tab and: Ensure the group containing Admins is added with Read and Enroll permissions. Optionally, enable Autoenroll if needed. Finally Click on OK to save the new template. Let the Group Policy refresh automatically or manually force it by running gpupdate /force. Once refreshed, the Domain Controller (DC) should receive a new Kerberos Authentication Certificate. Enroll Client Smart Card Certificate: On a Windows 10/11 device, Open Command Prompt and run “certreq -enroll "<SmartCard Certificate Template Name>" Ensure the appropriate Smart Card certificate is selected, then click Next to proceed with the certificate issuance. Insert the FIDO2 Security Key. Once the system detects the security key, it will prompt you to enter the PIN to store the certificate The process of storing certificate in FIDO2 Security key completes and now we can test accessing server using RDP with security key Testing: Open mstsc.exe and enter the target server’s FQDN. If the security key is detected by the system, it will prompt you to use the smart card for login. Enter the PIN, and it should allow you to sign in successfully Once authentication is successfully completed, RDP should load the desktop. Troubleshooting: During my research and extensive testing in my lab, I encountered few errors when enrolling certificates on the FIDO2 Security Key PIV. One of the issues I faced was the smart card showing as locked. After troubleshooting, I found that sometimes the FIDO2 security key device driver provided by the vendor is not installed properly. Ensure that you follow the security key provider’s installation guide and install the latest driver on both the client and target server. Another common error I encountered was: "The requested key container does not exist in smart card." This issue typically occurs when the FIDO2 Security Key driver is not installed properly on the target server. Again, refer to the FIDO2 security vendor’s documentation to install the correct driver. . Note: Ensure that when you attempt RDP to the target server, the user for whom you issued the smart card certificate is added to the "Remote Desktop Users" group on the target server. If you are looking to use RDP from the internet, we have the option of KDC Proxy to use. You can refer this article here for more details. I hope you found this blog useful in achieving passwordless authentication even for on-prem Active Directory domain-joined critical servers and I would like to thank you for reading this blog. Hopefully I will be back soon with some more interesting blogs.
Set default onedrive folder location for entire domain
Hey Everyone, We're using roaming profiles ( %USERPROFILE% is a network location) and the onedrive folders being placed here is causing the obvious issues. So I have the following question: Can I override the default %userprofile% Onedrive folder location through a gpo or registry key setting using a group policy? (or possibly another method). I've set up the latest gpo (and found a lot of usefull settings) but don't see the default folder location setting on that list. Thank you in advance for any trouble to be taken
Powershell command on domain computers as administrator
Hi, I want to execute a command on all computers in my domain but in order for it to work, it needs to run with elevated permissions. Is there a possibility to do this? my command: get-winevent -filterXML([xml](Get-Content "C:\Execute\Inventorview.xml")) | sort timecreated -descending | export-csv c:\execute\result.csv the response i get: get-winevent : Could not retrieve information about the Security log. Error: Poging tot het uitvoeren van een niet-gema chtigde bewerking.. At line:1 char:1 + get-winevent -filterXML([xml](Get-Content "C:\Execute\Inventorview.xm ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : LogInfoUnavailable,Microsoft.PowerShell.Commands.GetWinEventCommand (Poging tot het uitvoeren van een niet-gemachtigde bewerking... = dutch for 'trying to execute a non-authorized...') Thanks in advance!Feature Request, Let us use one set of User/Pass for multiple Related domains in Edge password mgr
This is a useful feature that LastPass has. this would prevent from creating multiple duplicate entries in Edge password manager and also manage logins more efficiently. in LastPass it's called Equivalent domains, the description says: "Add domains that use the same login service. We've already listed popular sites that use shared credentials across domains under their control. For example: amazon.com and its local variations, or gmail.com and other google products." it's pretty clear, instead of saving 2 password entries for Facebook.com and Messenger.com , we use the same set of username and password for both websites. this also makes it easy when user changes password for one website, because the other one will be updated automatically. here are more real and important examples: a bit hard to share it through Edge feedback and also keep the proper formatting but i'll try. DeletedIs it possible to control DNS client on Win 10
Hi, As we all know, the DNS is one of the services which is leaking information out from the organizations. I have read some plans to have possibilities to do filtering how much DNS servers are leaking data out. But in case your workstation is living two two different life: VPN and without VPN. So normally when workstation is having VPN established, all the DNS queries are of course traveling through the VPN. But when domain joined workstation is starting without VPN it is shooting many different internal DNS queries to the first available DNS server. And as we all know, those queries are plain text on the wire. Has any on here tried to solve this issue somehow? Having own DNS client for VPN and closing down OS's own DNS client? Or filtering DNS queries for internal domains by local FW?
EFS Files On domain Profile windows 10
Hi I am facing some issues related to EFs encryption files, I removed a domain profile entry from Regedit and Renamed User name Folder On windows 10. After login new profile created “same user”. There are some EFS encrypted files which noticed Later . Now i can see certificate but i cant change file permission attribute even from Local admin. Is there any way to decrypt those Files (word n excel files). Kindly help
Domain matching despite business verification rejection
Hello, I have been working with support in good faith after submitting a ticket request; they had asked me to submit proof of business name document and a domain registration document to verify that the domain I have on my profile matches the domain on the registration: " Dear Partner, Thank you for your inquiry about your Microsoft Partner Network account in Partner Center. We need more information from you to verify your Microsoft Partner Network account. To proceed with your request, and review your organization's status, please help us by emailing us the following documents. Please ensure that they are issued within the previous 12 months: Domain registration / Domain invoice at registration or renewal that lists Entity/Username and domain as it is stated on your account. Official business document, such as a business registration form, business charter, or articles of incorporation that lists Entity name and address as it is stated on your account. If not possible to provide additional documentation, please update your account information to match with documents already provided. List of supported file types and max. file size: screenshots (only from a source such as government) .pdf format Attachments larger than 8MB cannot be received by our system. Please advise if you are unable to provide smaller attachments. Thank you and best regards, Microsoft Operations " When I submitted initially, they said that there were unable to open the PDF documents that were attached (first time this has ever happened to me): "Dear Partner, We were unable to open any of the documents you have provided. Would you kindly send the documents again in the right format. Here is the list of the file types and max.file size that we require. screenshots (only from a source such as government) .pdf format Attachments larger than 8MB cannot be received by our system. Please advise if you are unable to provide smaller attachments. Thank you and best regards, Microsoft Operations" So I resubmitted the second time with screenshots showing that I have the PDF attached on my side and reattached the same PDFs as the last email. It appears that support then accepted the documents but sent this response: "Dear Partner, I am afraid that the provided document does not list the domain that appears on your Profile. If additional documentation containing this info is not available, please update your Profile to match the documents already provided. Thank you and best regards, Microsoft Operations" I am confident that the domain name on my profile exactly matched what is provided on the document, since it appears support accepted the domain registration document that I provided. Please see what should be attached as a screenshot below, showing the domain match: Domain registration document: Profile: Again, I have and am continuing to work with them to resolve this, so how can I get this moving forward? If further requested, I can provide the ticket number as well.Large-scale VDI deployment management with Active Directory and domains
Hello I am working for a start up and deployed RDS persitent VDI for just one enterprise which works perfectly. Now office wants to offer Persitent VDI to multiple company. I don't have much experience and would appreciate a guidance and solution for large-scale deployment. Do i have to create one Forest or multiple Forest? Do i have to create a Parent Domain then multiple child domain? Do i have to create multiple Domains? I don't want the Enterprise to be able to see each other or access other Enterprise files or software. like Teams and others. I intend to create multiple vlans per enteprise, my concern is Active Directory, RD broker, RD gateway and RD web. I will appreciate feedback, insight on how to create the domains and trust relationship. Best regards
