Authentication silos - User won't get claims

Question

Hey,

i am trying to setup authentication silos. I followed the setup instructions as writtin in technet. In my test environment it is working like a charm. When i log on on the machine with my user account which are both members of the silo i get a user claim ( cmd -> whoami /claims ).

Am i doing it exact this way in my production environment i am not allowed to log on any machine even the ones which are in the silo. After some digging i found out that my user doesn't get a claim since the output of "whoami /claims" gets me a "there are no claims available"

Our prod environment is based on 2016/2019 DCs. forest and domain level is 2016. member servers which i am tested it on are 2012 to 2019. all systems are up to date. all relevant gpo settings for member servers and the DCs are configured.

Any ideas where i can start digging why claims aren't issued to the user account?

Answer 1

Hello

Based on the link you provided, I did a test in my lab.

1.Add a domain user (t1) to Protected Users group.

2.Create Authentication Policy.

3.Create Authentication Policy Silo.

4.Bind Authentication Policy and Authentication Policy Silo to user account (t1)

5.Configure the following group policy setting (through local group policy)for Win10-1809 above.
Computer Configuration > Administrative Templates > System > Kerberos >Kerberos client support for claims, compound authentication and Kerberos armoring

6.Configure the following group policy setting through Default Domain Controller Policy object) for domain controller.
Computer Configuration > Administrative Templates > System > KDC > Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring

7.When I user domain account (B\t1) to logon client, I can not logon with error message.

We can check if we missed some configurations or some configurations is mis configured.

For more information, we can refer to the link below.

Authentication Policies and Authentication Policy Silos
http://www.rebeladmin.com/2016/03/authentication-policies-and-authentication-policy-silos/

Best Regards,
Daisy Zhou

Answer 2

Hello

Based on the link you provided, I did a test in my lab.

1.Add a domain user (t1) to Protected Users group.

2.Create Authentication Policy.

3.Create Authentication Policy Silo.

4.Bind Authentication Policy and Authentication Policy Silo to user account (t1)

5.Configure the following group policy setting (through local group policy)for Win10-1809 above.
Computer Configuration > Administrative Templates > System > Kerberos >Kerberos client support for claims, compound authentication and Kerberos armoring

6.Configure the following group policy setting through Default Domain Controller Policy object) for domain controller.
Computer Configuration > Administrative Templates > System > KDC > Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring

7.When I use domain account (B\t1) to logon client, I can not logon with error message.

We can check if we missed some configurations or some configurations is misconfigured.

For more information, we can refer to the link below.

Authentication Policies and Authentication Policy Silos
http://www.rebeladmin.com/2016/03/authentication-policies-and-authentication-policy-silos/

Best Regards,
Daisy Zhou

Answer 3

So i enabled kerberos debugging in my test and productive environment. when i logon with a user i get the error "0xe KDC_ERR_ETYPE_NOTSUPP" in our productive environment. this one i don't get in the test environment. so i guess sth. wrong with kerberos.

any ideas?