Protected Users and protected accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit f628eec · +32 −32 lines · also on GitHub
⋯ 83 unchanged lines
8484
#### Troubleshoot TGT expiration
8585
Normally, the domain controller sets the TGT lifetime and renewal based on the domain policy as shown in the following Group Policy Management Editor window.
8686
87
−
87
+
8888
8989
For **Protected Users**, the following settings are hard-coded:
9090
⋯ 4 unchanged lines
9595
#### Troubleshoot delegation issues
9696
Previously, if a technology that uses Kerberos delegation was failing, the client account was checked to see if **Account is sensitive and cannot be delegated** was set. However, if the account is a member of **Protected Users**, it might not have this setting configured in Active Directory Administrative Center (ADAC). As a result, check the setting and group membership when you troubleshoot delegation issues.
9797
98
−
98
+
9999
100100
### <a name="BKMK_AuditAuthNattempts"></a>Audit authentication attempts
101101
To audit authentication attempts explicitly for the members of the **Protected Users** group, you can continue to collect security log audit events or collect the data in the new operational administrative logs. For more information about these events, see [Authentication Policies and Authentication Policy Silos](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn486813(v=ws.11))
⋯ 14 unchanged lines
116116
117117
- Deny delegation with unconstrained or constrained delegation: To restrict an account, open Active Directory Administrative Center (ADAC) and select the **Account is sensitive and cannot be delegated** check box.
118118
119
− 
119
+ 
120120
121121
## <a name="BKMK_CreateAuthNPolicies"></a>Authentication policies
122122
Authentication Policies is a new container in AD DS that contains authentication policy objects. Authentication policies can specify settings that help mitigate exposure to credential theft, such as restricting TGT lifetime for accounts or adding other claims-related conditions.
⋯ 9 unchanged lines
132132
### Quick Kerberos refresher
133133
The Kerberos authentication protocol consists of three types of exchanges, also known as subprotocols:
134134
135
−
135
+
136136
137137
- The Authentication Service (AS) Exchange (KRB_AS_*)
138138
⋯ 18 unchanged lines
157157
158158
- Access control conditions to restrict user sign-on, which must be met by devices from which the AS exchange is coming
159159
160
−
160
+
161161
162162
You can restrict service ticket requests through a ticket-granting service (TGS) exchange by configuring:
163163
⋯ 19 unchanged lines
183183
184184
1. In the Default Domain Controllers Policy, click **Enabled** to enable **Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring** in Computer Configuration | Administrative Templates | System | KDC.
185185
186
− 
186
+ 
187187
188188
2. Under **Options**, in the drop-down list box, select **Always provide claims**.
189189
190190
> [!NOTE]
191191
> **Supported** can also be configured, but because the domain is at Windows Server 2012 R2 DFL, having the DCs always provide claims will allow user claims-based access checks to occur when using non-claims aware devices and hosts to connect to claims-aware services.
192192
193
− 
193
+ 
194194
195195
> [!WARNING]
196196
> Configuring **Fail unarmored authentication requests** will result in authentication failures from any operating system which does not support Kerberos armoring, such as Windows 7 and previous operating systems, or operating systems beginning with Windows 8, which have not been explicitly configured to support it.
⋯ 2 unchanged lines
199199
200200
1. Open Active Directory Administrative Center (ADAC).
201201
202
− 
202
+ 
203203
204204
> [!NOTE]
205205
> The selected **Authentication** node is visible for domains which are at Windows Server 2012 R2 DFL. If the node does not appear, then try again by using a domain administrator account from a domain that is at Windows Server 2012 R2 DFL.
206206
207207
2. Click **Authentication Policies**, and then click **New** to create a new policy.
208208
209
− 
209
+ 
210210
211211
Authentications Policies must have a display name and are enforced by default.
212212
213213
3. To create an audit-only policy, click **Only audit policy restrictions**.
214214
215
− 
215
+ 
216216
217217
Authentication policies are applied based on the Active Directory account type. A single policy can apply to all three account types by configuring settings for each type. Account types are:
218218
⋯ 7 unchanged lines
226226
227227
4. To configure a TGT lifetime for user accounts, select the **Specify a Ticket-Granting Ticket lifetime for user accounts** check box and enter the time in minutes.
228228
229
− 
229
+ 
230230
231231
For example, if you want a 10-hour maximum TGT lifetime, enter **600** as shown. If no TGT lifetime is configured, then if the account is a member of the **Protected Users** group, the TGT lifetime and renewal is 4 hours. Otherwise, TGT lifetime and renewal are based on the domain policy as seen in the following Group Policy Management Editor window for a domain with default settings.
232232
233
− 
233
+ 
234234
235235
5. To restrict the user account to select devices, click **Edit** to define the conditions that are required for the device.
236236
237
− 
237
+ 
238238
239239
6. In the **Edit Access Control Conditions** window, click **Add a condition**.
240240
241
− 
241
+ 
242242
243243
##### Add computer account or group conditions
244244
245245
1. To configure computer accounts or groups, in the drop-down list, select the drop-down list box **Member of each** and change to **Member of any**.
246246
247
− 
247
+ 
248248
249249
> [!NOTE]
250250
> This access control defines the conditions of the device or host from which the user signs on. In access control terminology, the computer account for the device or host is the user, which is why **User** is the only option.
251251
252252
2. Click **Add items**.
253253
254
− 
254
+ 
255255
256256
3. To change object types, click **Object Types**.
257257
258
− 
258
+ 
259259
260260
4. To select computer objects in Active Directory, click **Computers**, and then click **OK**.
261261
262
− 
262
+ 
263263
264264
5. Type the name of the computers to restrict the user, and then click **Check Names**.
265265
266
− 
266
+ 
267267
268268
6. Click OK and create any other conditions for the computer account.
269269
270
− 
270
+ 
271271
272272
7. When done, then click **OK** and the defined conditions will appear for the computer account.
273273
274
− 
274
+ 
275275
276276
##### Add computer claim conditions
277277
278278
1. To configure computer claims, drop-down Group to select the claim.
279279
280
− 
280
+ 
281281
282282
Claims are only available if they are already provisioned in the forest.
283283
284284
2. Type the name of OU, the user account should be restricted to sign on.
285285
286
− 
286
+ 
287287
288288
3. When done, then click OK and the box will show the conditions defined.
289289
290
− 
290
+ 
291291
292292
##### Troubleshoot missing computer claims
293293
If the claim has been provisioned, but is not available, it might only be configured for **Computer** classes.
294294
295295
Let's say you wanted to restrict authentication based on the organizational unit (OU) of the computer, which was already configured, but only for **Computer** classes.
296296
297
−
297
+
298298
299299
For the claim to be available to restrict User sign-on to the device, select the **User** check box.
300300
301
−
301
+
302302
303303
#### Provision a user account with an authentication policy with ADAC
304304
305305
1. From the **User** account, click **Policy**.
306306
307
− 
307
+ 
308308
309309
2. Select the **Assign an authentication policy to this account** check box.
310310
311
− 
311
+ 
312312
313313
3. Then select the authentication policy to apply to the user.
314314
315
− 
315
+ 
316316
317317
#### Configure Dynamic Access Control support on devices and hosts
318318
You can configure TGT lifetimes without configuring Dynamic Access Control (DAC). DAC is only needed for checking AllowedToAuthenticateFrom and AllowedToAuthenticateTo.
319319
320320
Using either Group Policy or Local Group Policy Editor, enable **Kerberos client support for claims, compound authentication and Kerberos armoring** in Computer Configuration | Administrative Templates | System | Kerberos:
321321
322
−
322
+
323323
324324
### <a name="BKMK_TroubleshootAuthnPolicies"></a>Troubleshoot Authentication Policies
325325
326326
#### Determine the accounts that are directly assigned an Authentication Policy
327327
The accounts section in the Authentication Policy shows the accounts that have directly applied the policy.
328328
329
−
329
+
330330
331331
#### Use the Authentication Policy Failures - Domain Controller administrative log
332332
A new **Authentication Policy Failures - Domain Controller** administrative log under **Applications and Services Logs** > **Microsoft** > **Windows** > **Authentication** has been created to make it easier to discover failures due to Authentication Policies. The log is disabled by default. To enable it, right-click the log name and click **Enable Log**. The new events are very similar in content to the existing Kerberos TGT and service ticket auditing events. For more information about these events, see [Authentication Policies and Authentication Policy Silos](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn486813(v=ws.11)).
⋯ 86 unchanged lines
419419
420420
2. In **Display name**, type a name for the silo. In **Permitted Accounts**, click **Add**, type the names of the accounts, and then click **OK**. You can specify users, computers, or service accounts. Then specify whether to use a single policy for all principals or a separate policy for each type of principal, and the name of the policy or policies.
421421
422
− 
422
+ 
423423
424424
### <a name="BKMK_ManageAuthnSilosUsingPSH"></a>Manage authentication policy silos by using Windows PowerShell
425425
This command creates an authentication policy silo object and enforces it.
⋯ 40 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.