RPC Endpoint Mapper Client Authentication uses NTLM

Question

Introduction

The main goal is to secure existent windows 10 clients. As there a few hardening recommendations from for example CIS and Microsoft concerning secure OS configuration i discovered a potential misleading dependency regarding NTLM and RPC.

 

How it happened

On windows 10 clients in the computermanagement (local admin group) the therein contained domain-members were only shown with their SID. Long story short, the actual name of the ADuser was not displayed anymore.

 

Solution

In the end it turned out that the following configuration based on a hardening configuration of CIS was the root cause:

 

"18.8.37.1 Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled' (MS only)"

More information here

 

Basically there should not be a problem when enabling the RPC Endpoint Mapper Client Authentication.

 

But if you configured 

"Restrict NTLM: Outgoing NTLM traffic to remote servers"

More information here

 

then the enabled RPC Endpoint Mapper Client Authentication will not work anymore because it does rely on NTLM.

 

Conclusion

A risk assessment must now be carried out here. 

 

Even Microsoft says that "It's encouraged to move away from NTLM to better secure your environment. If faced with a choice between restricting NTLM and using EnableAuthEpResolution, the recommended approach is that you restrict NTLM in your environment."

More information here

 

--> To sum up, even CIS recommends to enable the RPC Endpoint Mapper Client Authentication, but they do not make any statement in their benchmarks with regard to the denying of outgoing NTLM traffic to remote servers.

 

Question

• Which configuration will have a more severe risk and what should be the recommendation here regarding to achieve an overall secure configuration?

 

Answer 1

We are going down the road of blocking NTLM. RPC can be protected via IPSEC so you don't have to choose one or the other. The only issue is that the CIS rule will be an exception that you'll have to explain to your auditors why you chose not to implement RPC authentication.