Tag: Security identifier (SID)

The purposes for which a digital certificate may be used are controlled via the "Key Usage" and "Extended Key Usage" certificate extensions. The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Justin Bollinger from TrustedSec has found out that with offline certificate requests against schema version 1 certificate templates it is possible (similar to the Security Identifier extension ) to include arbitrary Application Policies in the certificate request, which are transferred unchanged to the issued certificate and can then be used to attack the Active Directory forest. The attack was named ESC15.

Continue reading "New ESC15 vulnerability discovered in Active Directory Certificate Services - easy-to-implement countermeasures"

Assume the following scenario:

• A certificate-based logon is performed with user or computer accounts to log them on to a wireless (IEEE 802.11 or Wireless LAN) or wired network (IEEE 802.3), or to a remote access connection (e.g. DirectAccess, Routing and Remote Access (RAS), Always on VPN ).
• As a server for authentication, authorization and accounting (AAA), the company uses the Network Policy Server (NPS) from Microsoft.
• Logging on to the network is no longer possible.
• The Network Policy Server logs the following event when a logon attempt is made:

Network Policy Server denied access to a user. [...] Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

Der Netzwerkrichtlinienserver hat einem Benutzer den Zugriff verweigert. [...] Authentifizierungsfehler aufgrund der Nichtübereinstimmung von Benutzeranmeldeinformationen. Der angegebene Benutzername ist keinem vorhandenen Benutzerkonto zugeordnet, oder das Kennwort war falsch.

Continue reading "Logons via the Network Policy Server (NPS) fail with reason "Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.""

Continue reading "Details of the event with ID 39 of the source Microsoft-Windows-Kerberos-Key-Distribution-Center"

As the operator of a certification authority, you are (among other things) responsible for the identification of the enrollees and the confirmation of the requested identities . The fact that this task is carried out conscientiously and without error is the central pillar of the trust placed in the certification authority. Well-known companies have already failed at this task , even had to file for insolvency as a result of misissuances and/or were severely punished by the big players in the market.

In many cases, we as (Microsoft) PKI operators in companies (regardless of the associated quality) are able to delegate our task of uniquely identifying an enrollee to the Active Directory. In many cases, however, we unfortunately also have to instruct our certification authority(ies) to simply issue everything that is requested.

Continue reading "A policy module to tame them all: Introducing the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services"

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

Continue reading "Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754)"

When configuring a certificate template, one must decide on the intended certificate content, i.e., among other things, which identities are confirmed by the certificates and how they are mapped.

In the "Subject Name" tab of the certificate template configuration dialog, you can configure how the identity confirmed by the certificate is mapped.

Continue reading "About the "Build this from Active Directory information" option for certificate templates"

Continue reading "Details of the event with ID 4889 of the source Microsoft-Windows-Security-Auditing"

Continue reading "Details of the event with ID 4888 of the source Microsoft-Windows-Security-Auditing"

Continue reading "Details of the event with ID 4887 of the source Microsoft-Windows-Security-Auditing"