[Solved] How do I properly add a wildcard domain to Edge tracking prevention exception list?
Found the solution, which was there in front of my eyes all this time but I didn't pay enough attention. Edge shows the correct syntax [*.]example.com so entering [*.]live.com is acceptable and fixes the issue! lesson learned: always pay attention to the info on the screen.Passwordless RDP Authentication for On-Prem Servers with Smart Cards (FIDO2 Security Key)
Hello Everyone, in my previous blog, I discussed how to use FIDO2 Security Key Passwordless Authentication with Entra or Hybrid Joined devices for Remote Desktop Connection. In this blog, we will discuss how a FIDO2 Security Key can be used as a smart card for Remote Desktop Connection Protocol on on-prem Active Directory domain-joined servers. If you have not gone through my last article, you can click here. Many people have written several articles and blogs on similar topics, so I apologize if you find it duplicate. Recently, a customer asked me whether it was possible to authenticate using a FIDO2 security key to connect to a remote on-prem domain joined server via RDP. I successfully enabled it for them and decided to write a blog on the topic. This is a great use case for administrators who frequently use high-privileged groups like Domain Admins and Enterprise Admins, as they should adopt passwordless authentication for secure day-to-day server management using smart card-based authentication. Basically, what I will be demonstrating here is Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), which is an extension of the Kerberos Authentication protocol that allows users to authenticate using certificates. There are some vendors who facilitate PIV (Personal Identification Verification) in security keys for strong authentication. With PIV, we can use the security key to store certificates for authentication. So, let’s discuss how we can use this feature to go passwordless by accessing the remote desktop of servers. First of all, we need a PKI infrastructure or a Certificate Server, which we can deploy on Windows Server by adding the Certificate Services role or using an existing one. Once we have a certificate server, we can configure the certificate templates for users and domain controllers. In order to use RDP for servers, both the client and domain controller (DC) need to have a valid certificate as they use mutual authentication. We can issue a “User or Smart Card Logon” certificate to users and a “Kerberos Authentication” certificate to DCs. Before we get into settings and configuration, let’s understand how Kerberos PKINIT works at a high level, which will further help us understand the entire process of this activity. Kerberos Public Key Cryptography for Initial Authentication (PKINIT) in the Kerberos protocol enables the use of public key cryptography in the initial authentication exchange. It uses X.509 certificates (Smart Card) in place of a password to authenticate against the authentication server. The key components involved here are: The Domain Client running Windows 10/11, who wants to access a remote server over RDP. The Domain Controller (KDC) running on at least Windows Server 2016, which authenticates users in Active Directory. The Domain Member Server running on at least Windows Server 2016, which is the target system the client wants to connect to. A Certificate Authority (CA) running on at least Windows Server 2016, which issues Kerberos Authentication and User or Smart Card Logon certificates. Authentication Flow: The Client selects a smart card during authentication, which sends an AS-REQ (Authentication Service Request) to the Domain Controller (KDC) containing the user’s X.509 certificate. It essentially signs the current time with its private key. The Domain Controller validates the request by checking the times using the user’s public key. Once the Domain Controller completes the validation, it issues a TGT (Ticket Granting Ticket) signed by the KDC certificate using its private key as an AS-REP (Authentication Service Reply) response. The Client validates the TGT by verifying the KDC’s certificate. Once the Client has the TGT, it can proceed to request a service ticket to connect to the target server. It is important to note that if we have an Enterprise or AD-integrated Certificate Authority, the Root CA or Issuing CA's certificate will be automatically added to the Trusted Root Certification Authorities store in domain-joined systems. In case we use a standalone CA, we must manually add its certificate to the client machine’s Trusted Root Certification Authorities store. Now, let’s go through the whole process step by step. We will first start by creating a template for the Domain Controller (DC) certificate and later for User certificates. We will also see how to configure Group Policy for certificate auto-enrollment to issue certificates to users and DCs. Issue Kerberos Authentication Certificate to Domain Controller: Go to the Certificate Server and open the Certificate Authority console. Click on Templates and then click on Manage. The Domain Controller (DC) requires the KDC Authentication certificate (1.3.6.1.5.2.3.5) EKU and Server Authentication (1.3.6.1.5.5.7.3.1) EKU. Select the Kerberos Authentication template. Select the Kerberos Authentication template and create a duplicate template. Next, do not make any changes to the certificate template except for assigning a name under the General tab. Go to the Security tab and ensure that only the Domain Controllers group is added with Read, Enroll, and Autoenroll permissions selected. Under the Subject Name tab, ensure the DNS checkbox is selected. Next, we need to issue the Kerberos Authentication certificate template to make it available for Domain Controllers (DCs) to request certificates. Group Policy Configuration: Next, we need to create a Group Policy for certificate auto-enrollment and link it to the Domain Controllers OU. Open the GPO and go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies. Edit Certificate Service Client – Auto Enrollment Properties and select Renew Expired Certificate and update Certificate options as shown in picture below. Go to Computer Configuration\Windows Settings\Security Settings\Public Key Policies and set "Certificate Services Client – Certificate Enrollment Policy" to Enabled. We also need to create another Group Policy Object (GPO) and link it to the domain to enable additional policies for the Client & Server to accept smart card authentication for RDP connections. This policy will determine how the system should behave when the smart card is removed. In this case, it will be set to disconnect the session. Go to Computer Configuration\Windows Settings\Security Settings\Security Options and enable "Define this policy setting" and select option "Disconnect if a Remote Desktop Services Session" Next, we will enable the use of smart cards by setting the policy "Allow ECC certificates to be used for logon and authentication" under: Computer Configuration\Administrative Templates\Windows Components\Smart Card Create Smart Card Logon Certificate Template for Client: Now, go back to the Certificate Server, open the Certificate Authority console, and open the Manage console by right-clicking on Certificate Templates. Select the Smart Card Logon template, right-click, and choose Duplicate Template. Under the Compatibility tab, set: Certificate Authority to Windows Server 2016 Certificate Recipients to Windows 10/Windows Server 2016 Next, go to the General tab and assign a name of your choice. This is the same certificate that the user will see when they issue a smart card certificate to be stored in the FIDO2 Security Key. Go to the Request Handling tab and: Under Purpose, select "Include symmetric algorithms allowed by the subject." Enable "For automatic renewal of smart card certificates, use existing key if a new key cannot be created." To ensure the certificate is saved in the FIDO2 Security Key during the request, select "Prompt the user during enrollment and require user input when the private key is used." Note: I tested the "Prompt the user during enrollment" option, but it did not work. Next, go to the Cryptography tab and: Under Provider Category, select "Key Storage Provider." In Algorithm Name, choose "ECDH_P384" (assuming you meant P384, as P383 is not a standard option). Under Cryptographic Provider, select "Request must be one of the following providers" and choose "Microsoft Smart Card Key Storage Provider." Change Request Hash to "SHA256." Next, go to the Security tab and: Ensure the group containing Admins is added with Read and Enroll permissions. Optionally, enable Autoenroll if needed. Finally Click on OK to save the new template. Let the Group Policy refresh automatically or manually force it by running gpupdate /force. Once refreshed, the Domain Controller (DC) should receive a new Kerberos Authentication Certificate. Enroll Client Smart Card Certificate: On a Windows 10/11 device, Open Command Prompt and run “certreq -enroll "<SmartCard Certificate Template Name>" Ensure the appropriate Smart Card certificate is selected, then click Next to proceed with the certificate issuance. Insert the FIDO2 Security Key. Once the system detects the security key, it will prompt you to enter the PIN to store the certificate The process of storing certificate in FIDO2 Security key completes and now we can test accessing server using RDP with security key Testing: Open mstsc.exe and enter the target server’s FQDN. If the security key is detected by the system, it will prompt you to use the smart card for login. Enter the PIN, and it should allow you to sign in successfully Once authentication is successfully completed, RDP should load the desktop. Troubleshooting: During my research and extensive testing in my lab, I encountered few errors when enrolling certificates on the FIDO2 Security Key PIV. One of the issues I faced was the smart card showing as locked. After troubleshooting, I found that sometimes the FIDO2 security key device driver provided by the vendor is not installed properly. Ensure that you follow the security key provider’s installation guide and install the latest driver on both the client and target server. Another common error I encountered was: "The requested key container does not exist in smart card." This issue typically occurs when the FIDO2 Security Key driver is not installed properly on the target server. Again, refer to the FIDO2 security vendor’s documentation to install the correct driver. . Note: Ensure that when you attempt RDP to the target server, the user for whom you issued the smart card certificate is added to the "Remote Desktop Users" group on the target server. If you are looking to use RDP from the internet, we have the option of KDC Proxy to use. You can refer this article here for more details. I hope you found this blog useful in achieving passwordless authentication even for on-prem Active Directory domain-joined critical servers and I would like to thank you for reading this blog. Hopefully I will be back soon with some more interesting blogs.
Set default onedrive folder location for entire domain
Hey Everyone, We're using roaming profiles ( %USERPROFILE% is a network location) and the onedrive folders being placed here is causing the obvious issues. So I have the following question: Can I override the default %userprofile% Onedrive folder location through a gpo or registry key setting using a group policy? (or possibly another method). I've set up the latest gpo (and found a lot of usefull settings) but don't see the default folder location setting on that list. Thank you in advance for any trouble to be takenFeature Request, Let us use one set of User/Pass for multiple Related domains in Edge password mgr
This is a useful feature that LastPass has. this would prevent from creating multiple duplicate entries in Edge password manager and also manage logins more efficiently. in LastPass it's called Equivalent domains, the description says: "Add domains that use the same login service. We've already listed popular sites that use shared credentials across domains under their control. For example: amazon.com and its local variations, or gmail.com and other google products." it's pretty clear, instead of saving 2 password entries for Facebook.com and Messenger.com , we use the same set of username and password for both websites. this also makes it easy when user changes password for one website, because the other one will be updated automatically. here are more real and important examples: a bit hard to share it through Edge feedback and also keep the proper formatting but i'll try. Deleted
Powershell command on domain computers as administrator
Hi, I want to execute a command on all computers in my domain but in order for it to work, it needs to run with elevated permissions. Is there a possibility to do this? my command: get-winevent -filterXML([xml](Get-Content "C:\Execute\Inventorview.xml")) | sort timecreated -descending | export-csv c:\execute\result.csv the response i get: get-winevent : Could not retrieve information about the Security log. Error: Poging tot het uitvoeren van een niet-gema chtigde bewerking.. At line:1 char:1 + get-winevent -filterXML([xml](Get-Content "C:\Execute\Inventorview.xm ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : LogInfoUnavailable,Microsoft.PowerShell.Commands.GetWinEventCommand (Poging tot het uitvoeren van een niet-gemachtigde bewerking... = dutch for 'trying to execute a non-authorized...') Thanks in advance!Is it possible to control DNS client on Win 10
Hi, As we all know, the DNS is one of the services which is leaking information out from the organizations. I have read some plans to have possibilities to do filtering how much DNS servers are leaking data out. But in case your workstation is living two two different life: VPN and without VPN. So normally when workstation is having VPN established, all the DNS queries are of course traveling through the VPN. But when domain joined workstation is starting without VPN it is shooting many different internal DNS queries to the first available DNS server. And as we all know, those queries are plain text on the wire. Has any on here tried to solve this issue somehow? Having own DNS client for VPN and closing down OS's own DNS client? Or filtering DNS queries for internal domains by local FW?
EFS Files On domain Profile windows 10
Hi I am facing some issues related to EFs encryption files, I removed a domain profile entry from Regedit and Renamed User name Folder On windows 10. After login new profile created “same user”. There are some EFS encrypted files which noticed Later . Now i can see certificate but i cant change file permission attribute even from Local admin. Is there any way to decrypt those Files (word n excel files). Kindly helpLarge-scale VDI deployment management with Active Directory and domains
Hello I am working for a start up and deployed RDS persitent VDI for just one enterprise which works perfectly. Now office wants to offer Persitent VDI to multiple company. I don't have much experience and would appreciate a guidance and solution for large-scale deployment. Do i have to create one Forest or multiple Forest? Do i have to create a Parent Domain then multiple child domain? Do i have to create multiple Domains? I don't want the Enterprise to be able to see each other or access other Enterprise files or software. like Teams and others. I intend to create multiple vlans per enteprise, my concern is Active Directory, RD broker, RD gateway and RD web. I will appreciate feedback, insight on how to create the domains and trust relationship. Best regardsVVSS1: vivaldi suggestions for edge devs part 1 - search query - download - bottom bar - history
Vivaldi Suggestions (VVSS): 1 Few on the previous submitted links so that Devs can have all that in 1 on this website too. <<<<<<<<<<<<<<<<<< WHY? 7a) You could search for %S directly and then add the search engine 😕 no because there are a lot of %s alternative, i copy the same link to other mac apps too, and they use things like #TEXT# {search} @haste and a lot more. every app should convert xxx to .... so xxx to %s xxx to #TEXT# etc. plus is much faster to write xxx compared to %s. last point: search with %s doesn't work always ------- and remember so better integration between chrome-vivaldi-edge-etc. (which was previously reported) Yes i know, probably never happen from google like ***id=750534 which is still not fixed... but at least between edge-brave-vivaldi-opera <<<<<<<<<<<<<<<<<< 4) i want that every mm of my browser is used for something. there is so much space here, we could add quick access buttons like reload left, reload right, save pdf, save page, open tab to the right in new window, tab to the right to a new group, launch profile 2, save to webarchive, etc... there are so many things we could add in this bar. <<<<<<<<<<<<<<<<<< <<<<<<<<<<<<<<<<<< based on my previously suggestion of pip mode specific history remember to add this too <<<<<<<<<<<<<<<<<< Use different color on download progress bar to make it easy to recognize download status in panel/button: 0% ~ 25% = Orange 25%+ = Gold 50%+ = Yellow 75%+ = Green 100% completed = Blue EDIT: Use such colors inside the /download panel, where background color is red when failed, green when 100%, etc. <<<<<<<<<<<<<<<<<<
