Active Directory
A set of directory-based technologies included in Windows Server.
5,174 questions
Access Denied in Event Viewer Remote Connection in azure joined devices
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 42%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERC%3C/text%3E%3C/svg%3E)
Raghuram Chandrasekaran
5
Reputation points
In the on-premise AD Joined machine's Event viewer, Connect to another computer worked with the AD Credentials. But in Azure Joined machines, Connecting with Entra ID Credentials results in Azure denied. Any idea why it results like that? Is there any difference in the authentication? I would like to know what I am doing wrong.
Two machines that I'm trying to establish a connection to are also Azure Joined with Windows 11 pro. I tried all username formats in Entra, but it resulted in an unknown username, Creating Windows Event ID 4625. The Entra user I'm trying to perform this operation has global admin permission in Entra and is a member of local Event Log Readers.
The username format that I used
- azuread\username@domain.onmicrosoft.com
- username@domain.onmicrosoft.com
- azuread\username
- username
- domain\username.
Help on this matter would be very useful!
{count} vote
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 97%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Matt Axtell 5 Reputation points2023-11-06T14:42:12.5066667+00:00 I have the same issues. These are my testing steps:
- Excluded my 2 test devices from all CSPs I thought could interfere.
- Open administrative cmd and run "winrm quickconfig" to get the ball rolling. This opens the HTTP firewall port automatically. Did this on each device.
- Enable these firewall groups on each device:
- Windows Management Instrumentation (WMI) - Domain Group
- Remote Service Management - Domain Group
- Remote Scheduled Task Management - Domain Group
- Remote Event Monitor - All Group
- Remote Event Log Management - Domain Group
- Remote Event Monitor - All Group
- Remote Scheduled Task Management - Domain Group
- Remote Service Management - Domain Group
- Windows Management Instrumentation (WMI) - Domain Group
- Created a local account on each device with matching usernames and passwords
- Ran Computer Management as this user on device 1
- Tried a remote connection to device 2
- Access granted!
- Tried the same steps but using an AAD joined account with local admin rights on both hosts to device 2
- Access denied!
So I think I'm there in terms of getting a local account to connect, just not an AAD account. Both devices are W11 with latest updates as of today. Both devices work the same the other way round. I saw this but this didn't work:
I saw this and I kind of thought using AAD isn't going to be possible:
I think I'm going to resort to using Azure LAPS for remote management tasks for now.
Sign in to comment