MAC Authentication Bypass with NPS Not Working After KB5008102

Question

Hello. A few weeks ago KB5008102 was applied to domain controllers. From my understanding it requires computer objects created to have a trailing $ at the end of the sAMAccountName. Prior this, I'd add computer objects in the form of a MAC address, for example 111122223333, and they'd authenticate when connected. Now, for new computer objects, I have to add as 111122223333$, but authentication fails at the NPS, and the device is seen as so by the NPS server

Security ID: NULL SID
Account Name: 111122223333
Account Domain: ADU
Fully Qualified Account Name: ADU\111122223333

The reason code is 16, "Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account of the password was incorrect.

//BREAK//

For existing computer objects defined prior the KB5008102, they continue to be seen as Security ID: ADU\xxxxxxxxxxxx

A current NPS policy for lets say VLAN 107 matches on condition Authentication Type "PAP" and User Groups "ADU\BLDG23A_VLAN107".
I don't have the necessary permissions to delete the trailing $ from a sAMAccountName. I was wondering, how could I create a new policy that would authenticate these new computer objects who have a trailing $ at the end of the sAMAccountName? Thanks.

Answer 1

Hello @Ch3ll

Before creating a new policy, check this out first. The reason code is 16 means that either the client computer attempted to use an authentication method that is not enabled on the matching network policy or the client computer attempted to authenticate as Guest, but guest authentication is not enabled.

MAC address authorization is performed when the user does not type in any user name or password and refuses to use any valid authentication method.

MAC Address Authorization
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197535(v=ws.10)?redirectedfrom=MSDN

Hope this resolves your Query!!

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

LimitlessTechnology-2700
Thanks for the feedback. I looked at the registry but those don't exist; we're on Windows Server 2016. As that article states, I have been able to create user accounts where the MAC address is the username, but I have to do so in the users OU. Nonetheless, authentication is successful. Prior the KB5008102 we've always worked out of a computer OU, and with a script were able to create it as a "user" account, sAMAccountType 805306368 = ( NORMAL_USER_ACCOUNT ). However, now in this computer OU, objects can only be created as sAMAccountType 805306369 (MACHINE_ACCOUNT) and will have the $ at the end of the sAMAccountName.

I've tried pattern matching regular expressions in the Calling-Station-Identifier attribute of a policy, but it never matches, not even on the exact MAC address, and I highly suspect its because of the mandatory $ being placed at the end of the sAMAccountName.

Answer 3

I have the same problem, also copy of an old user don´t work.

the original

Benutzer:
	Sicherheits-ID:			***\60d039-647c99
	Kontoname:			60d039-647c99
	Kontodomäne:			***
	Vollqualifizierter Kontoname:	***\60d039-647c99

the copy is seen as:

Benutzer: 	Sicherheits-ID:			NULL SID 	
Kontoname:			04ed33-283282 	
Kontodomäne:			*** 	
Vollqualifizierter Kontoname:	***\04ed33-283282