Hello,
I've been having some trouble getting DAC device claims to work, and I was wondering whether anyone could point me in the right direction.
The environment is configured as follows:
Domain Controllers (hostnames dc01, dc02, dc03)
- Server 2016
- Domain and Forest functional level = 2008 R2
- KDC support for claims, compound authentication and Kerberos armoring set to "Enabled"/"Supported" via group policy
- User based claim for attribute "l" enabled for users
- Device based claim for attribute "location" enabled for computers
File server (hostname server01)
- Server 2016
- Shared directory (test_share) configured.
- Share level permissions configured to allow Everyone full control.
- File system permissions configured to allow user ab01 unconditional read/execute access
- An additional ACL is configured to allow user ab01 full control conditional on either:
- user.l = "secure" or
- device.location = "secure"
- Conditional permissions are applied directly via security descriptor (i.e. no central access rules / policies are involved)
- Kerberos client support for claims, compound authentication and Kerberos armoring set to "Enabled" via group policy
- msDS-SupportedEncryptionTypes = 0x1c
Client machine (hostname pc01)
- Windows 10
- Attribute "location" set to "secure"
- Kerberos client support for claims, compound authentication and Kerberos armoring set to "Enabled" via local policy
- Support for compound authentication set to "Enabled"/"Always" via local policy.
- msDS-SupportedEncryptionTypes = 0x1c
User account (ab01)
- Account attribute "l" set to "secure"
- Account supports Kerberos AES 128 and 256 bit encyrption
- Use Kerberos DES encryption types for this account is unchecked.
Similar to a previous question along these lines (https://social.technet.microsoft.com/Forums/lync/en-US/1522933d-d004-430b-9251-6f7bcc6891f8/dac-device-claims-not-being-generatedpassed?forum=winserverDS), user based claims seem to work well: When the conditional
permission based on a user claim is configured, then user ab01 has full control of test_share.
The effective permissions (evaluated on the file server) also appear to give the desired results: When conditional permissions are configured to use a device based claim (ab01 has full control when device.location="secure"), user ab01 is shown
to have full control from pc01, but not from machines where device.location is undefined, or doesn't equal "secure". In real life however, user ab01 only has read/execute permissions when accessing test_share from pc01. Any attempt to create or modify
files/folders generates a permissions error.
Various events with id 4626 show up at regular intervals in the logs on the file server and DCs:
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: Domain01\ab01
Account Name: ab01
Account Domain: Domain01
Logon ID: 0x11111111
Event in sequence: 1 of 1
User Claims: ad://ext/l:1111111111111111 <String> : "secure"
Device Claims: -
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: Domain01\PC01$
Account Name: PC01$
Account Domain: Domain01
Logon ID: 0x111111
Event in sequence: 1 of 1
User Claims: ad://ext/location:1111111111111111 <String> : "secure"
Device Claims: -
Klist shows the following on PC01:
#4> Client: ab01 @ Domain01
Server: cifs/server01 @ Domain01
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
Start Time: 1/2/2020 5:15:40 (local)
End Time: 1/2/2020 14:56:47 (local)
Renew Time: 1/8/2020 19:11:48 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0x40 -> FAST
Kdc Called: dc03.domain01
Any advice on getting device claims working (or on how I can find more information about why they're not…) would be much appreciated.
Many thanks in advance