Our Intranet impersonates the logged on user against NTFS file permissions on our file server from Windows 10, but fails to do so from a clean install of Windows 11

Phil Jones 0

We have an app on our Intranet which impersonates the logged on user against NTFS file permissions on our file server. This works from a Windows 10 computer and from a computer upgraded to Windows 11 from Windows 10, but fails on a computer with a clean install of Windows 11

2 answers

Limitless Technology 44,496 Reputation points

2023-06-06T09:24:29.8066667+00:00

Hello there,

Is there anything in event viewer?

I would suggest you to use proc mon to identify if there is nothing on the event viewer.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file

system, Registry and process/thread activity. You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/procmon

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log

system activity to the Windows event log.You can get the tool from here

https://docs.microsoft.com/enus/sysinternals/downloads/sysmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
MotoX80 34,761 Reputation points

2023-06-06T11:39:20.41+00:00

So you are doing IIS impersonation to access a network share on another server using Active Directory and Kerberos authentication? Correct?

That is the infamous double-hop issue.

Have you reviewed this page?

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-authentication-authorization/kerberos-double-hop-authentication-edge-chromium
Please sign in to rate this answer.
Phil Jones 0 Reputation points

2023-06-07T13:36:59.43+00:00

OK, I reviewed that link and I do not understand how it explains why a user can connect to the resources through our Intranet using a computer which has been updated to Windows 11 from WIndows 10, but cannot do so with a computer on which Windows 11 was installed as a clean install.

MotoX80 34,761 Reputation points

2023-06-07T14:11:46.53+00:00

I have no way of knowing what specific registry entry or file version might be different between a vanilla Win11 and a Win11 that was upgraded from Win10.

My interpretation of that page is that if you have set up delegation, then IE and Edge (prior to ver 87) use unconstrained delegation. That is, the user browses a site which then accesses \\FileServer1\share and \\FileServer2\share.

By default, Internet Explorer passes the flag to InitializeSecurityContext, indicating that if the ticket can be delegated, then it should be. Microsoft Edge from version 87 and above doesn't pass the flag to InitializeSecurityContext just because the ticket is marked with the ok_as_delegate flag.

Edge on the other hand work differently. Look at the image after this paragraph.

By default, Microsoft Edge works with constrained delegation, where the IIS website running on Web-Server only has the right to contact the backend API site hosted on API-Server, as shown in the application pool identity account configuration from Active Directory listed below:

So if the Win11 machine is using constrained delegation, then you need to identify your file server the way that the image shows api-server.

You should be able to use the klist tool to compare the 2 Win11 machines.

Use the klist command tool present in Windows to list the cache of Kerberos tickets from the client machine (Workstation-Client1 in the diagram above). Look for a ticket named HTTP/<Name of Web-Server>. Note: <Name of Web-Server> is the SPN of the service you wish to contact and authenticate to via Kerberos. The ticket also contains a few flags. Two of them are of interest: forwardable and ok_as_delegate.

Please note, I am retired and no longer have access to an Active Directory environment to test with. You probably should add the Windows Server, Active Directory, and Internet Information Services tags to this question.

I would also expect you to find some error in the security eventlog on the web or file server.

See my answer from May 9 where I mention double hop in this post.

https://learn.microsoft.com/en-us/answers/questions/1279770/asp-net-create-powershell-as-logged-in-user

Back where I was still working I used the delegconfig tool to troubleshoot this issue. Looks like that hasn't been updated in years, so I don't know if it still works.

I also found a Github tool that might also help you.

Also verify that the win11 machine is using kerberos to authenticate.

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-authentication-authorization/troubleshoot-kerberos-failures-ie
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Our Intranet impersonates the logged on user against NTFS file permissions on our file server from Windows 10, but fails to do so from a clean install of Windows 11

2 answers

Your answer