Modifying AdminSDHolder Permission Delegation

Description:

You want to delegate permission to write certain user attribute for member of protected groups in Active Directory to a "normal" users. You have add the permission at the AdminSDholder container through GUI for that "normal" users. However during testing, you find that the "normal" users is still unable to modify the protected groups users attribute.

Resolution:

You need to use command line instead of GUI.

In order to grant access to a specific user object attribute, for example department, use dsacls:

dsacls “CN=AdminSDHolder,CN=System,DC=example,DC=com” /G Allow-User-Management:WP;department;

Using Microsoft Graph to Find Inactive Guest Users in Azure Active Directory

Description:

You have been using Azure Active Directory for a while. Now you notice you have several "external - guest" user listed in your Azure AD users. You need to gather the list of inactive guest user account.

Resolution:

We can try to get the list of inactive users by using Microsoft Graph.

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"

 #Logon using Global Admin

$guestUsers = Get-MgUser -Filter "userType eq 'Guest' and accountEnabled eq true" -Property DisplayName, UserPrincipalName, SignInActivity, CreatedDateTime

$inactiveGuestUsers = $guestUsers | Where-Object {($_.SignInActivity.LastSignInDateTime -lt (Get-Date).AddDays(-90)) -or ($_.SignInActivity.LastSignInDateTime -eq $null)}

# Display the list of inactive guest users

$inactiveGuestUsers | Select-Object DisplayName, UserPrincipalName, @{Name="LastSignInDateTime"; Expression={$_.SignInActivity.LastSignInDateTime}}, CreatedDateTime

Windows 2019 NPS Server Firewall Exclusion

Description:

You have completed the NPS configuration using Windows Server 2019. You have put the correct secrets at the VPN servers. You also have make sure there's no Network Firewall between the VPN server and NPS Server. 

However client machine cannot connect to the VPN. And you cannot see the traffic reaching the NPS Server. There's nothing in the NPS Server event viewer.

Resolution:

At the NPS server, open command prompt with elevated permission and type:

sc sidtype IAS unrestricted

Restart the server after that.

Windows Defender Firewall on the NPS should be automatically configured with exceptions, during the installation of NPS, to allow this RADIUS traffic to be sent and received.

With Server 2019 this firewall exception requires a modification to the service account security identifier to effectively detect and allow RADIUS traffic. If this security identifier change is not executed, the firewall will drop RADIUS traffic. The above command changes the IAS (RADIUS) service to use a unique SID instead of sharing with other NETWORK SERVICE services.

Failed F5 Big-IQ connection to Azure MFA

Description

You have setup Azure MFA with NPS Extension in your Organization. You have make sure the firewall from and to your NPS server is configure properly. You have also make sure the internet connection from NPS Server to Azure MFA is working properly
Now, you want to test the the connection from your F5 Big-IQ to the NPS Server. However you got an error saying "Failed while connecting to radius server, server responded with: Access-Challenge". 

You also notice that there are No authentication challenge or prompt at Microsoft Authenticator Apps. 

From the event viewer you can see the following "NPS Extension for Azure MFA: CID xxxxx : Challenge requested in Authentication Ext for user Domain\UserName with state xxxxx".

Resolution

NPS extension version 1.2.2216.1 or later is prompted to sign in with a TOTP method instead of Approve/Deny. If the Client doesn't support it, take the following steps to return to the Approve/Deny behavior.
Go to NPS Server, open the Registry Editor.

1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa.
2. Create the following String/Value pair:

1. Name: OVERRIDE_NUMBER_MATCHING_WITH_OTP
2. Value = FALSE

Restart the NPS Service.

Cannot Delete DNS Zone - Access was Denied

Description:

You have several DNS Zone listed in your Active Directory Integrated DNS Server.

One day, you want to remove one of the DNS Zone there. However you got an error message saying Access was Denied.

You are already using a Domain Admins account.

Resolution:

You or other Admin probably already set the protection from accidental deletion for those DNS Zones.

On the DNS Manager Console, go to the DNS Zone that you want to delete. Open the properties and go to Security Tab. Open Advanced and Edit the Everyone (Deny) permission. Remove the check mark on the Delete Objects and Delete All Child Objects permission. Click Apply, click Ok.

You should be able to delete the DNS Zone.