Theoretical Headbanging
Edit 3: We have a video! -- Edit: Oh hey, we announced our strategy . We've been hinting at the deprecation and removal of NTLM from Windows for a while now. We're finally talking about how we're doing it. Bluehat Podcast (not the presentation): The BlueHat Podcast: Deprecating NTLM is Easy and Other Lies We Tell Ourselves with Steve Syfuhs on Apple Podcasts Webinar Recording (not Bluehat): The…
Saved for when Future Steve goes searching for examples on how to do this again. I had a project that required acting as a server by opening a socket on a particular port and then listen for incoming connections. Not that particularly interesting. However, the process of building it was kind of a pain because the program would periodically linger in the background holding the socket open and…
It's Friday afternoon, it's sunny out, and I have no desire to start on any new projects this late in the week. Let's discuss architectural changes to Kerberos cryptography in Windows! Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just dumb.…
Update Dec 2: If you're finding this post as a result of the November 2022 Windows patch, I recommend you review KB5021131: How to manage the Kerberos protocol changes related to CVE-2022-37966 - Microsoft Support if you haven't already. Pay special attention to this registry key: DefaultDomainSupportedEncTypes Configurable value to state what the default Supported Encryption Type for an Active…
This is just a list of all the things I've written on Windows authentication. I've sorted it by rabbit hole. Architectural Things What Happens When you Type Your Password into Windows? How Azure AD Windows Sign-in Works How Windows Single Sign-On Works How Authentication Works when you use Remote Desktop Identity Delegation in Active Directory How Managed Service Accounts in Active Directory Work…
In the spirit of distracting myself from Doom Scrolling, let's talk about a feature that is super useful that many folks don't really know a lot about: Remote Credential Guard. I've gone into relatively great detail about all the different stages of Windows auth and I encourage everyone to read through the posts because there's literally centuries of dev hours put into building all of this and…
Windows Hello Cloud Trust : What is it? Why do you care? A thread. — Steve Syfuhs (@SteveSyfuhs) February 22, 2022 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just dumb. In the early days, Windows Hello for Business came in two…
Yesterday we announced the public preview of, amongst other things, Azure AD Kerberos. I discussed a bit about how we did it , and why the features depend on it. But I didn't really explain why we chose the solution we did. Here's why. There are... mmmmmm ...a bajillion... Windows devices out in the world today (give or take). Some running the latest and greatest Windows 11, others running various…
Every time I write out a long thread on some technical topic I inevitably see someone replying to my first post tagging a bot and telling it to unroll the thread. I block every single one of those bots. They won't work. I will go out of my way to make sure they don't work. Why? Because they make money off my content without lifting a finger. I actually don't care if someone reuses my work. Go to…
I spent the better part of the last two years building the authentication stack used by FSLogix in Azure Virtual Desktop for AADJ machines . — Steve Syfuhs (@SteveSyfuhs) December 1, 2021 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just…
In the spirit of people being wrong on the internet, I wanted to briefly discuss something people rarely get right: the computer account password. Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just dumb. Your computer has an account in Active…
It's been a while since our last thread and I need to kill time while a ginormous time travel trace file finishes copying, so let's talk a bit about LSA, the Windows Local Security Authority. Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just…
There was an internal discussion going on about folks getting too many MFA prompts when they're using RDP. I've danced around this topic quite a bit in past threads, but maybe let's take a look at it: how MFA works in Windows. In Windows-land MFA comes in all sorts of flavors. Often what folks see is just a second field on the Windows logon screen to enter a one time password or send a request to…
EDIT 2: Oh hey, we announced our strategy . EDIT: Good news. Deprecating NTLM is Easy and Other Lies We Tell Ourselves (syfuhs.net) So I joked earlier today that the reason we can't kill NTLM is because folks turn off telemetry. That's false. Mostly. Here's why. — Steve Syfuhs (@SteveSyfuhs) May 5, 2021 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier…
Was pulled in to a fun customer issue last Friday around disabling RC4 in Active Directory. What happened was, as you can imagine, not good: RC4 was disabled and half their environment promptly started having a Very Bad Day. — Steve Syfuhs (@SteveSyfuhs) March 1, 2021 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details…
Have you ever thought to yourself "boy, I sure wish I had to use passwords more often"? No, of course not. Passwords suck. Good passwords are long and hard to remember and easy to remember passwords aren't good. They're inherently portable and easy to steal. — Steve Syfuhs (@SteveSyfuhs) February 12, 2021 Twitter warning: Like all good things this is mostly correct, with a few details…
Have you ever heard of these things called Managed Service Accounts? They allow you to run programs as an account that doesn't require a password while still having the security of a strong password. They're pretty neat. pic.twitter.com/p7nfDnyUqp — Steve Syfuhs (@SteveSyfuhs) February 4, 2021 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than…
Have you ever wondered what happens when you type your password into Windows? With the cloud becoming a major part of our world, we find ourselves having to talk to both on-premises and cloud-native resources, which dramatically affects what happens when you do type your password into Windows. Follow along as Steve Syfuhs gives a guided tour of how Windows handles logons internally and secures…
Have you ever had an app that authenticated users, and then thought wouldn't it be great if it could act as that user for the services it has to call later? This has historically been called Impersonation, Delegation, Act As, or On Behalf Of depending on protocols in play. — Steve Syfuhs (@SteveSyfuhs) January 26, 2021 Twitter warning: Like all good things this is mostly correct, with a few…
Have you ever tried to access an admin SMB share on your local machine (\\localname\c$) only to find out you don't have admin perms despite being a local administrator? Why is that? Here's something you maybe didn't know: It's by design -- it's a way of preventing UAC bypass. pic.twitter.com/1SwNrWn4j8 — Steve Syfuhs (@SteveSyfuhs) January 19, 2021 Twitter warning: Like all good things this…
Speaking of #passwordless ... did you ever wonder how we made it work with on-prem Active Directory? It's kind of magic. We built a KDC in the cloud. Here's how it works... https://t.co/ww7qtg0r3P — Steve Syfuhs (@SteveSyfuhs) August 21, 2020 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b)…
It's Monday evening, the weather is great, and we're in the middle of a pandemic. Lets talk Kerberos! Or rather, it's little known nephew FAST and Armoring. — Steve Syfuhs (@SteveSyfuhs) July 28, 2020 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c)…
No! Network Level Authentication is how Windows authenticates remote desktop clients and servers before sending your credentials over to a remote machine. If the client can't authenticate the remote server then there's no guarantee it's the server you actually want to log in to, and therefore may be a server trying to steal your credentials. This is why you see a credentials prompt when using RDP…
So, there was a major attack recently. Apropos of that, I wanted to re-up how we (Microsoft) recommend folks lay out their environments for security-mindedness. In short we call it Privileged Administration. It's the foundation of our (ugh) zero trust model. — Steve Syfuhs (@SteveSyfuhs) December 22, 2020 Twitter warning: Like all good things this is mostly correct, with a few details…
Okay, lets talk Credential Guard. What is it, why it matters, and how it works. — Steve Syfuhs (@SteveSyfuhs) December 1, 2020 Twitter warning: Like all good things this is mostly correct, with a few details fuzzier than others for reasons: a) details are hard on twitter; b) details are fudged for greater clarity; c) maybe I'm just dumb. Credential Guard is a Windows service that protects…