[Solved] How do I properly add a wildcard domain to Edge tracking prevention exception list?
Found the solution, which was there in front of my eyes all this time but I didn't pay enough attention. Edge shows the correct syntax [*.]example.com so entering [*.]live.com is acceptable and fixes the issue! lesson learned: always pay attention to the info on the screen.Passwordless RDP Authentication for On-Prem Servers with Smart Cards (FIDO2 Security Key)
Hello Everyone, in my previous blog, I discussed how to use FIDO2 Security Key Passwordless Authentication with Entra or Hybrid Joined devices for Remote Desktop Connection. In this blog, we will discuss how a FIDO2 Security Key can be used as a smart card for Remote Desktop Connection Protocol on on-prem Active Directory domain-joined servers. If you have not gone through my last article, you can click here. Many people have written several articles and blogs on similar topics, so I apologize if you find it duplicate. Recently, a customer asked me whether it was possible to authenticate using a FIDO2 security key to connect to a remote on-prem domain joined server via RDP. I successfully enabled it for them and decided to write a blog on the topic. This is a great use case for administrators who frequently use high-privileged groups like Domain Admins and Enterprise Admins, as they should adopt passwordless authentication for secure day-to-day server management using smart card-based authentication. Basically, what I will be demonstrating here is Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), which is an extension of the Kerberos Authentication protocol that allows users to authenticate using certificates. There are some vendors who facilitate PIV (Personal Identification Verification) in security keys for strong authentication. With PIV, we can use the security key to store certificates for authentication. So, let’s discuss how we can use this feature to go passwordless by accessing the remote desktop of servers. First of all, we need a PKI infrastructure or a Certificate Server, which we can deploy on Windows Server by adding the Certificate Services role or using an existing one. Once we have a certificate server, we can configure the certificate templates for users and domain controllers. In order to use RDP for servers, both the client and domain controller (DC) need to have a valid certificate as they use mutual authentication. We can issue a “User or Smart Card Logon” certificate to users and a “Kerberos Authentication” certificate to DCs. Before we get into settings and configuration, let’s understand how Kerberos PKINIT works at a high level, which will further help us understand the entire process of this activity. Kerberos Public Key Cryptography for Initial Authentication (PKINIT) in the Kerberos protocol enables the use of public key cryptography in the initial authentication exchange. It uses X.509 certificates (Smart Card) in place of a password to authenticate against the authentication server. The key components involved here are: The Domain Client running Windows 10/11, who wants to access a remote server over RDP. The Domain Controller (KDC) running on at least Windows Server 2016, which authenticates users in Active Directory. The Domain Member Server running on at least Windows Server 2016, which is the target system the client wants to connect to. A Certificate Authority (CA) running on at least Windows Server 2016, which issues Kerberos Authentication and User or Smart Card Logon certificates. Authentication Flow: The Client selects a smart card during authentication, which sends an AS-REQ (Authentication Service Request) to the Domain Controller (KDC) containing the user’s X.509 certificate. It essentially signs the current time with its private key. The Domain Controller validates the request by checking the times using the user’s public key. Once the Domain Controller completes the validation, it issues a TGT (Ticket Granting Ticket) signed by the KDC certificate using its private key as an AS-REP (Authentication Service Reply) response. The Client validates the TGT by verifying the KDC’s certificate. Once the Client has the TGT, it can proceed to request a service ticket to connect to the target server. It is important to note that if we have an Enterprise or AD-integrated Certificate Authority, the Root CA or Issuing CA's certificate will be automatically added to the Trusted Root Certification Authorities store in domain-joined systems. In case we use a standalone CA, we must manually add its certificate to the client machine’s Trusted Root Certification Authorities store. Now, let’s go through the whole process step by step. We will first start by creating a template for the Domain Controller (DC) certificate and later for User certificates. We will also see how to configure Group Policy for certificate auto-enrollment to issue certificates to users and DCs. Issue Kerberos Authentication Certificate to Domain Controller: Go to the Certificate Server and open the Certificate Authority console. Click on Templates and then click on Manage. The Domain Controller (DC) requires the KDC Authentication certificate (1.3.6.1.5.2.3.5) EKU and Server Authentication (1.3.6.1.5.5.7.3.1) EKU. Select the Kerberos Authentication template. Select the Kerberos Authentication template and create a duplicate template. Next, do not make any changes to the certificate template except for assigning a name under the General tab. Go to the Security tab and ensure that only the Domain Controllers group is added with Read, Enroll, and Autoenroll permissions selected. Under the Subject Name tab, ensure the DNS checkbox is selected. Next, we need to issue the Kerberos Authentication certificate template to make it available for Domain Controllers (DCs) to request certificates. Group Policy Configuration: Next, we need to create a Group Policy for certificate auto-enrollment and link it to the Domain Controllers OU. Open the GPO and go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies. Edit Certificate Service Client – Auto Enrollment Properties and select Renew Expired Certificate and update Certificate options as shown in picture below. Go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies and set "Certificate Services Client – Certificate Enrollment Policy" to Enabled. We also need to create another Group Policy Object (GPO) and link it to the domain to enable additional policies for the Client & Server to accept smart card authentication for RDP connections. This policy will determine how the system should behave when the smart card is removed. In this case, it will be set to disconnect the session. Go to Computer Configuration\Windows Settings\Security Settings\Security Options and enable "Define this policy setting" and select option "Disconnect if a Remote Desktop Services Session" Next, we will enable the use of smart cards by setting the policy "Allow ECC certificates to be used for logon and authentication" under: Computer Configuration\Administrative Templates\Windows Components\Smart Card Create Smart Card Logon Certificate Template for Client: Now, go back to the Certificate Server, open the Certificate Authority console, and open the Manage console by right-clicking on Certificate Templates. Select the Smart Card Logon template, right-click, and choose Duplicate Template. Under the Compatibility tab, set: Certificate Authority to Windows Server 2016 Certificate Recipients to Windows 10/Windows Server 2016 Next, go to the General tab and assign a name of your choice. This is the same certificate that the user will see when they issue a smart card certificate to be stored in the FIDO2 Security Key. Go to the Request Handling tab and: Under Purpose, select "Include symmetric algorithms allowed by the subject." Enable "For automatic renewal of smart card certificates, use existing key if a new key cannot be created." To ensure the certificate is saved in the FIDO2 Security Key during the request, select "Prompt the user during enrollment and require user input when the private key is used." Note: I tested the "Prompt the user during enrollment" option, but it did not work. Next, go to the Cryptography tab and: Under Provider Category, select "Key Storage Provider." In Algorithm Name, choose "ECDH_P384" (assuming you meant P384, as P383 is not a standard option). Under Cryptographic Provider, select "Request must be one of the following providers" and choose "Microsoft Smart Card Key Storage Provider." Change Request Hash to "SHA256." Next, go to the Security tab and: Ensure the group containing Admins is added with Read and Enroll permissions. Optionally, enable Autoenroll if needed. Finally Click on OK to save the new template. Let the Group Policy refresh automatically or manually force it by running gpupdate /force. Once refreshed, the Domain Controller (DC) should receive a new Kerberos Authentication Certificate. Enroll Client Smart Card Certificate: On a Windows 10/11 device, Open Command Prompt and run “certreq -enroll "<SmartCard Certificate Template Name>" Ensure the appropriate Smart Card certificate is selected, then click Next to proceed with the certificate issuance. Insert the FIDO2 Security Key. Once the system detects the security key, it will prompt you to enter the PIN to store the certificate The process of storing certificate in FIDO2 Security key completes and now we can test accessing server using RDP with security key Testing: Open mstsc.exe and enter the target server’s FQDN. If the security key is detected by the system, it will prompt you to use the smart card for login. Enter the PIN, and it should allow you to sign in successfully Once authentication is successfully completed, RDP should load the desktop. Troubleshooting: During my research and extensive testing in my lab, I encountered few errors when enrolling certificates on the FIDO2 Security Key PIV. One of the issues I faced was the smart card showing as locked. After troubleshooting, I found that sometimes the FIDO2 security key device driver provided by the vendor is not installed properly. Ensure that you follow the security key provider’s installation guide and install the latest driver on both the client and target server. Another common error I encountered was: "The requested key container does not exist in smart card." This issue typically occurs when the FIDO2 Security Key driver is not installed properly on the target server. Again, refer to the FIDO2 security vendor’s documentation to install the correct driver. . Note: Ensure that when you attempt RDP to the target server, the user for whom you issued the smart card certificate is added to the "Remote Desktop Users" group on the target server. If you are looking to use RDP from the internet, we have the option of KDC Proxy to use. You can refer this article here for more details. I hope you found this blog useful in achieving passwordless authentication even for on-prem Active Directory domain-joined critical servers and I would like to thank you for reading this blog. Hopefully I will be back soon with some more interesting blogs.
Forward/be notified of emails sent to nonexistent address on same domain? Not admin. School account.
My student email address (Outlook) contains a misspelling of my name (one missing letter). So it's very easy for people to send their emails to an address that doesn't exist, thinking they're sending it to me. What would be great if I could somehow have those emails forwarded to the correct address, or at least be notified when people try to send an email to the nonexistent address. I've tested things a bit. When I try sending an email to the "wrong" (correct spelling of my name, but nonexistent) address, I usually get an email from Microsoft indicating the mistake. But not always. And even when I do, it sometimes takes a few minutes, or it goes to some easily overlooked folder besides the main inbox. I worry that busy people might send an email to the wrong address and move on, never noticing the following error email. I know one obvious solution is to ask my school's IT department to make a new address with the correct spelling, and have all emails sent to the previous incorrectly-spelled address forwarded to the new one. But 1. I don't know if I'll be allowed to keep two addresses, and 2. I don't trust Outlook to successfully forward everything to the new address. I'd rather use a "catch-all" solution, where emails sent to the correctly spelled (but nonexistent) address are automatically forwarded to the existing (but incorrectly spelled) address. Or maybe I can somehow get a notification that someone has tried to send an email to the nonexistent address? Are either of these (or something else I haven't thought of) possible? Before taking this to my school's IT department, I want to see if there's anything I can do myself. Like I said, it's a student email address, so my options are probably limited. But I'm wondering if I have access to any settings (I mainly use the web version of Outlook, but I also have the PC app), or if there's any 3rd party solutions I can implement on my own that could accomplish something like what I have in mind. If I do end up having to ask my school's IT department for help, what should I tell them to try?
Two Exchange servers in one domain
Hello everybody, I want ask you, because I can’t find how “Exchange magic” works. I have two seperate Exchange DAG clusters in one domain, with different DNS records and different Virtual Directories URLs. Servers are on two physically diferent locations, but we create a direct connection between two locations for migration mailboxes in near future. We notice sometimes clients from old enviroment can connect through new enviroment and access to mailboxes on old servers. How is it possible? What communication ongoing between old and new Exchange enviroments? Can somebody explain me specifically? Thank you very much for answer to this mystery.Connecting an existing domain to another windows server.
I am new to EC2's and am wanting to create a server that I can connect people on remotely. I have created a domain called "test.r1" I have a static IP on the EC2. Do i need to configure this on server manager. If so how do I do this. Through IPV4 properties. On the other server I have tried to add a domain controller to an existing domain but when typing the domain "test.r1" it displays "the server is not operational" I have been stuck trying to figure out why I can't connect my domain to this EC2
Large-scale VDI deployment management with Active Directory and domains
Hello I am working for a start up and deployed RDS persitent VDI for just one enterprise which works perfectly. Now office wants to offer Persitent VDI to multiple company. I don't have much experience and would appreciate a guidance and solution for large-scale deployment. Do i have to create one Forest or multiple Forest? Do i have to create a Parent Domain then multiple child domain? Do i have to create multiple Domains? I don't want the Enterprise to be able to see each other or access other Enterprise files or software. like Teams and others. I intend to create multiple vlans per enteprise, my concern is Active Directory, RD broker, RD gateway and RD web. I will appreciate feedback, insight on how to create the domains and trust relationship. Best regards
Template for Azure Network // Building up a company network
Hello @all, maybe somebody could help me, I've got the following challenge: I have a "Company" - keep things simple so lets call it "company" This Companyhas a Domain - "company.corp" So far, so good. Now I need 3 "Subdomains" - aroot.a.corp - broot.b.corp - croot.corp (yes, without the "c") In every of these "Subdomains" I need an Exchangeserver. What is the target of the Challenge.? -> I want to setup an Useraccount (e.g. the Name could be "3Admin") which is able to collect informations from all those 3 Domains and set informations there - no matter where this account is logged on - so also from a windows 10 Machine, joined to one of these 3 domains.. So e.g. I want to Login into "aroot.a.corp" with the User "3Admin" and get Values from User XY. Then I want to set exactly those values to the User YZ in the Domain "broot.b.corp" without changing the DC or without a Step in between, just with a simple PowerShell command. maybe something like get a value from User XY (in the domain aroot.a.corp) and copy it to User YZ (in the domain broot.b.corp) And here is my question: How can I setup this environment.? Do I need 4 Domain Controllers and 4 Exchanges.? I appreciate every help. Thanks in advance.!
Windows Server Essentials 2019 shutting down on Domain Environment
Hello, the company that I work for uses Windows Server Essentials 2019 in our products, but we have been receiving complaints from our customers that servers are shutting down weekly when they have this machines added to the Domain environment. We can see that service SILSVC is the responsible for this action, but we don't know the reason. Is there a limitation of Essentials with Domain, or maybe a misconfiguration either on the Windows Roles or Domain configuration?
