- SID Filtering is also known as Quarantine, Domain Quarantine, or SID Filtering Quarantine.
- SID Filtering only applies to trusts, it cannot be enabled within a domain.
- SID Filtering, by default, is not active on automatically created trusts within a forest. You can enable it, but not if the forest functional level is below Windows Server 2003. Doing so on any trust within a forest breaks replication. Additionally, if the forest functional level is Windows Server 2003 or higher; users with universal group memberships from other domains in the forest may loose access to resources if you enable SID Filtering on any of your trusts.
- You can check the status of SID Filtering with the netdom.exe (Windows Domain Manager) command:
- To verify the status of SID Filtering between two domains:
netdom trust <TrustingDomainName> /domain: <TrustedDomainName> /quarantine
Example output:
SID filtering is not enabled for this trust. All SIDs presented in an authentication request from this domain will be honored.
This is the default setting between domains in the same forest. - To verify the status of SID Filtering between two forests:
netdom trust <TrustingDomainName> /domain: <TrustedDomainName> /enablesidhistory
Example output:
SID history is disabled for this trust.
This is the default setting between trusting forests. - As you can see the two commands are nearly identical, but /quarantine applies only to domain trusts and /enablesidhistory is only valid for an outbound forest trust. They also output totally different messages making it hard to see that they actually apply to the same thing.
- To verify the status of SID Filtering between two domains:
- More info:
Monthly Archives: January 2012
AdminSDHolder, Protected Groups, SDProp and moving mailboxes in Exchange
When you move a mailbox in Exchange 2000 or newer, you sometimes encounter an error saying that you have insufficient permissions to move the mailbox. Although that may be the case, usually this error is caused by the user object associated with the mailbox you are trying to move not having inheritable permissions enabled in Active Directory. This is also known as that the DACL is protected, i.e. it is special and should not be changed. But why is it protected?
Usually it is protected because the user was once a member of one of the protected administrative groups in Active Directory. (Notice the word ‘once’, it will be important later!) These groups are (per Windows Server 2008 R2):
- Enterprise Admins
- Schema Admins
- Domain Admins
- Administrators
- Account Operators
- Server Operators
- Print Operators
- Backup Operators
- Cert Publishers
Any user who is a direct or indirect member of any of these groups will get a protected DACL (inheritable permissions turned off) and the attribute adminCount set to 1. SDProp, or the Security Descriptor Propagator, thread within the LSASS.EXE process is responsible for checking and applying these settings once an hour. Any change you make to a protected object will be reset within the hour.
So back to moving mailboxes.
If the user is a member of any of the protected groups, the move mailbox process completes successfully since Exchange is aware of how to handle that scenario. But if the user has been removed from all protected groups the move process fails (remember I said “once a member of”).
The reason is that the user still has a protected DACL and the adminCount attribute set to 1. SDProp does not reverse its changes when you remove a user from a protected group. This is a scenario that Exchange does not know how to handle and so throws the insufficient permissions error. The easiest way to resolve the problem is to go into the Security tab of the user object, select Advanced and hit the Restore Defaults button. That will enable inheritance of permissions and remove any ACEs that SDProp (or any other process) has set explicitly. One important thing to know is that the Restore Defaults button does not reset the adminCount attribute back to 0, so you still have a user object in a non-consistent state (it is inheriting permissions, but still flagged as a special object). The best practice would be to manually clear adminCount with you favorite DS tool when you also enable permission inheritance.
Now that we know this it would be a good idea to find all the users that would fail when we tried to move them. To do this we would need to construct a query with the following criteria:
- Not a member of any of the protected groups
- Has a mailbox
- Has a protected DACL
My choice would be PowerShell. Here is an example using the Quest Active Directory cmdlets:
- Put all the known protected groups in an array:
$ADProtectedGroups = @(“Enterprise Admins”,”Schema Admins”,”Domain Admins”,”Administrators”,”Account Operators”,”Server Operators”,”Print Operators”,”Backup Operators”,”Cert Publishers”) - Find all the users and put them in an array:
$mismatchedUsers = Get-qaduser -sizelimit 0 -securitymask DACL –NotIndirectMemberOf $ADProtectedGroups -IncludedProperties homeMDB | Where-Object {(($_.DirectoryEntry.PSBase.ObjectSecurity.AreAccessRulesProtected) –
and ($_.homeMDB -ne $null))} - View the users if you like:
$mismatchedUsers | ft - Fix the users:
$mismatchedUsers | ForEach { Set-QADObjectSecurity $_ –UnLockInheritance | Set-QADObject -ObjectAttributes @{adminCount=$null} }
Note: You may also want to include adminCount=1 in your search to see which objects have it set, but you could then get back users that have been fixed before by pressing Restore Defaults or enabling inheritable permissions.
To search for users with adminCount=1:
$admincountUsers = Get-qaduser -sizelimit 0 -NotIndirectMemberOf $ADProtectedGroups -IncludedProperties homeMDB,adminCount | Where-Object {(($_.adminCount -eq 1) -and ($_.homeMDB -ne $null))}
Or to just find everything with adminCount=1:
Get-ADObject –LDAPFilter “(adminCount=1)”
“A certificate cloud not be found that can be used with this Extensible Authentication Protocol” error in IAS
After issuing a new certificate for a Windows Server 2003 running IAS this error presented itself in the IAS console when trying to configure EAP with the new certificate:
“A certificate could not be found that can be used with this Extensibel Authentication Protocol.”
This was accompanied by these two events in the System Log:
This was the new certificate, based on the default Computer template in Windows:
Notice the empty subject field, IAS/NPS does not accept certificates with empty subject names for use with EAP or Smart Cards. The certificate template that had been used for this certificate was a duplicate of the default Computer template. The template looked like this:
After creating a new template from the default Computer template, now with Subject name format set to Common name, and issuing a new certificate; IAS worked fine.
So don’t use certificate with blank subjects for your IAS/NPS servers…
An overview of groups used by Active Directory Certificate Services
This is a quick list of the groups associated with Active Directory Certificate Services.
CERTSVC_DCOM_ACCESS
Purpose: Grant DCOM access to Certificate Authority.
Default description: This group has no default description.
Group type: Local/Domain Local Security group.
Default members: Everyone/Domain Users and Domain Computers.
This group is created when Windows Server 2003 Service Pack 1 is installed on a Certificate Authority. If the CA is a member server (or in a workgroup); CERTSVC_DCOM_ACCESS is a computer local group, if the CA is a DC; CERTSVC_DCOM_ACCESS is a domain local group. Also when you install a Certificate Authority (CA) on a Windows Server 2003 machine that already has Service Pack 1 (or later); this group is created.
All security principals that need to enroll certificates from the CA must be a member, direct or indirect, of this group. If the CA is a member server; the Everyone security group is added to CERTSVC_DCOM_ACCESS. If the CA is a DC; the Domain Users and Domain Computers groups are added to CERTSVC_DCOM_ACCESS.
Only domains with a CA installed on a DC have this group, and only members servers with a CA have it as a computer local group. If you have several domains in your forest, only computers and users in the domain where the CA resides can request certificates. If other domains in the forest need to enroll certificates, security principals from those domains must be added to the group.
In Windows Server 2008 this group was replaced by the Certificate Service DCOM Access group (see own group into below).
More info:
- Description of the changes to DCOM security settings after you install Windows Server 2003 Service Pack 1
- Error message when a client computer requests a certificate from a computer that is running Windows Server 2003 with Service Pack 1: “The wizard cannot be started because of one or more of the following conditions”Certificate Service DCOM Access
Purpose: Grant DCOM access to Certificate Authority.
Default description: Members of this group are allowed to connect to Certification Authorities in the enterprise.
Group type: Builtin Local Security Group.
Default members: Authenticated Users.
This group serves the same purpose as CERTSVC_DCOM_ACCESS, but is created in Windows Server 2008 domains. It grants access to Certificate Authorities, but is a Builtin local group as opposed to CERTSVC_DCOM_ACCESS, which is a Local or Domain Local group.
Sometimes you will se both CERTSVC_DCOM_ACCESS and Certificate Service DCOM Access in a domain.
Cert Publishers
Purpose: Publish certificates to Active Directory.
Default description: Enterprise certification and renewal agents
Group Type: Global Security Group (Windows 2000)/Domain Local Security Group (Windows Server 2003 or later)
Default members: Certificate Authority computer account from same domain as group.
This group is created when an Active Directory domain is created. In Windows 2000 it is created as a Global Security Group, but in Windows Server 2003 or later it is created as a Domain Local Security Group.
If a Windows 2000 domain is upgraded to Windows Server 2003 or later, this group remains as a Global Security Group; it is not automatically updated to Domain Local scope. To change the group scope you can run this command:
- dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope lSometimes you cannot change the group scope directly to Domain Local. In this case, you have to run 2 commands:
- dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope u
(This command changes the global group into a universal group.) - dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope l
(This changes the group scope to Domain Local.)This group is granted Read userCertificate and Write userCertificate on all user and computer accounts in the domain where it resides. If the same domain contains a Certificate Authority the CA is added to this group, thus allowing it to publish certificates to the user or computer.The permissions granted to the Cert Publishers group in a domain are defined on the AdminSDHolder container located in <domain>/System. Changing the Cert Publishers group’s permissions on AdminSDHolder will change the permissions that Cert Publishers have on all objects in the domain.
In a multi-domain forest, the CA computer account(s) must be added to this group in all the domains where you want the CA to be able to publish certificates.
If you have a multi-domain forest the PowerShell script below will display the group scope and members of all the Cert Publishers groups in the forest:
#
# EnumerateAllCertPublishersMembers2.ps1
# by Morgan Simonsen, Atea
#
# List the group type, scope and members of the Cert Publishers group
# in every domain in a forest.
#
# More info:
# http://morgansimonsen.wordpress.com/2012/01/24/an-overview-of-groups-used-by-active-directory-certificate-services/
#$colCertPublishersGroups = @()
$forest = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Write-Host “Getting forest-wide membership of Cert Publishers groups…”
# Get members of ‘Cert Publishers’ for forest-root domain
$objTemp = New-Object System.Object
$objTemp | Add-Member -type NoteProperty -name “Domain” -value $forest.name$group = Get-QADGroup -Identity ( $forest.name + “/users/Cert Publishers” ) -Service $forest.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Group Name” -value $group.name
$objTemp | Add-Member -type NoteProperty -name “Group Type” -value $group.grouptype
$objTemp | Add-Member -type NoteProperty -name “Group Scope” -value $group.groupscope$members = Get-QADGroupMember -Identity ( $forest.name + “/users/Cert Publishers” ) -Service $forest.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Members” -value $members
If ( $members -ne $null )
{
ForEach ( $member in $members )
{
#Nothing
}
}
$colCertPublishersGroups += $objTemp$domain = $null
$group = $null
$members = $null
$objTemp = $null# Get members of ‘Cert Publishers’ for child domains
$forest.children | ForEach `
{
$objTemp = New-Object System.Object
$mydomain = Get-QADObject -Identity $_.name #-ea silentlycontinue$objTemp | Add-Member -type NoteProperty -name “Domain” -value $mydomain.name
$group = Get-QADGroup -Identity ( $_.name + “/users/Cert Publishers” ) -Service $_.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Group Name” -value $group.name
$objTemp | Add-Member -type NoteProperty -name “Group Type” -value $group.grouptype
$objTemp | Add-Member -type NoteProperty -name “Group Scope” -value $group.groupscope$members = Get-QADGroupMember -Identity ( $_.name + “/users/Cert Publishers” ) -Service $_.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Members” -value $members
If ( $members -ne $null )
{
ForEach ( $member in $members )
{
#Nothing
}
}
$colCertPublishersGroups += $objTemp$domain = $null
$group = $null
$members = $null
$objTemp = $null}
$colCertPublishersGroups
More info:
- Certification Authority configuration to publish certificates in Active Directory of trusted domain
- Cert Publishers scope changed from Global to Domain Local in Windows Server 2003
- Enterprise CA May Not Publish Certificates from Child Domain or Trusted Domain