<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:atom="https://www.w3.org/2005/Atom" xmlns:sy="https://purl.org/rss/1.0/modules/syndication/" xmlns:dc="https://purl.org/dc/elements/1.1/" xmlns:content="https://purl.org/rss/1.0/modules/content/" xmlns:wfw="https://wellformedweb.org/CommentAPI/" xmlns:slash="https://purl.org/rss/1.0/modules/slash/"
  version="2.0">
  <channel>
    <title>The 9z, by Chris Davis</title>
    <atom:link
      href="https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/feed.xml"
      rel="self"
      type="application/rss+xml" />
    <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/feed.xml</link>
    <description>An Active Directory, Windows Platform, Performance troubleshooting (and anything else interesting I run across) BLOG.</description>
    <lastBuildDate>Tue, 22 Nov 2016 16:26:57 GMT</lastBuildDate>
    <language>en-US</language>
    <sy:updatePeriod>hourly</sy:updatePeriod>
    <sy:updateFrequency>1</sy:updateFrequency>
    <item>
      <title>DNS isn't always the cause of "selected objects in the following domains are not available"</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/dns-isnt-always-the-cause-of-selected-objects-in-the-following-domains-are-not-available</link>
      <pubDate>Tue, 22 Nov 2016 16:26:57 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/?p=1155</guid>
      <description><![CDATA[So if you hit up the 'goog, bing'd it, and everyone that asks about this error:
The Active...]]></description>
      <content:encoded><![CDATA[So if you hit up the 'goog, bing'd it, and everyone that asks about this error:
The Active Directory Domain Controllers required to find the selected objects in the following domains are not available:
contoso.com
Ensure the AD Domain Controllers are available and try to select the object again
...gets told that it's their DNS. But if you're here, I assume you have checked and you don't have a DNS issue. It actually could be your security settings. This error happens when you try and add a user from the trusted domain to a security group in the trusting domain.
Most of the time this happens to people with a one-way trust. (For instance setting up an ESAE, Tier 0 forest, or "red forest"). And sure... DNS could cause this, but I have seen too many forums with people walking away without an answer. In fact the moderators of those forums will see the question, say it is DNS, then mark their own answers as final without confirming with the person who asked, and close the question. It is frustrating.
Here's the other thing that will cause this. The GPO setting:
Computer Configuration &gt; Administrative Templates &gt; System &gt; RemoteProcedure Call &gt; "Enable RPC Endpoint Mapper Client Authentication"
When set to enabled (which is a STIG finding that will soon be removed from 2008R2 and 2012+) it tells the computer account that any RPC communication must be mutually authenticated. Which... is sort of a problem when you only have a one-way trust. You can't just turn this to "Not configured" either, as the setting is tattoo'd. You have to disable it. Then, you have to reboot.
As a bit of trivia, if you had created a one-way trust that was external this wouldn't have happened. In fact, something much more bizarre will (I plan to write a blog about this as well). You can create the trust, add users, and even log on with them. But when logged on with an account from the trusting forest, you will have a frozen start menu. Administrators can't run things as administrator. PsGetSid will tell you that you have a broken trust when clearly you don't.
Strange stuff. Two issues with the same root cause. Hope this helps someone out there.]]></content:encoded>
    </item>
    <item>
      <title>Why doesn't NLA work with cross-domain smart card authentication?</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/why-doesnt-nla-work-with-cross-domain-smart-card-authentication</link>
      <pubDate>Mon, 02 May 2016 18:07:13 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/?p=1146</guid>
      <description><![CDATA[Well... actually it does. But you need a trust.

And by the way this will affect more than just...]]></description>
      <content:encoded><![CDATA[Well... actually it does. But you need a trust.

And by the way this will affect more than just smart card authentication to an RDP session, it will also affect copying files over UNC paths and basically anything else that requires authentication.

First though, let me back up a bit and talk about Network Level Authentication (NLA). This isn't technobabble, you really need to understand this to understand the problem.

OK. When you RDP to a server you chew up resources as the server remotely presents you with the graphical identification and authentication (GINA) screen. No matter who you are. This opens up a path to create a quick-and-dirty Denial of Service attack against a server by repeatedly sending thousands of these requests. If NLA is enabled, the source has to first "pre-authenticate" locally before a connection over RDP will even be allowed. So if you don't have the correct permissions, you can't launch such an attack. This topic is somewhat misunderstood in government circles because there are several Security Technical Implementation Guides (STIGS) referring to NLA as a protection against Man in the Middle (MitM) attacks. While there may be some merit to this, it was not what NLA was designed to accomplish. In addition, if you're going to require your users to authenticate with smart cards, this is irrelevant.

When you use smart card PKI certs for authentication, the exchange happens at the point where the card exists (better stated, the place where you enter your PIN to unlock the certificates on the card). The place where the private key exists. If you've ever launched remote desktop to a server and logged on with a smart card you've seen the GINA screen of the target server reading your smart card. This is because you've allowed your source computer to share the smart card (and its reader) with the target system so that the remote system can read the card as though it were physically present on that computer. In fact, it's so much an emulation that if you don't have the drivers for the reader or card on the remote system, it won't work. Proof that the card is literally "copied" (for lack of a better word) to the remote system. This persists as well past the GINA screen. Any time you need to authenticate, you'll see the password box followed by all the certificates present on the card as available to select. As you can see, this is very much different than how passwords work. (passwords can be forwarded on, certs with private keys can't).

But passwords work?!!? Chris, this must be a bug, right? Call the product team and have them fix it!!

Okay let's stop for a second (again) and cover a couple more important concepts. Right at this point we're talking about authentication, not authorization. What rights you have on that server (such as to log on via RDP) aren't in question yet, so put that aside for a second. All we're doing right now is validating that you are who you say you are. With a username/password that attestation is done by a trust that YOU are the only person who knows those two things. (And that is forwardable by hashing the password from anyone, to anyone.) With certificates, the attestation that you are who you say you are is based on the fact that you have the certificate in hand (and more specifically, in this case that you knew the PIN to unlock the smart card so you'd have a cert, meaning two factor). The certificate you have is issued by a trusted source (trusted by the target server). Just like when I get pulled over for speeding, the officer looks at my drivers license. He trusts the DMV as an issuer and if they validated that I'm Chris Davis, that's good enough for him. He only trusts me when I say I'm Chris Davis because he trusts them.

Because NLA is basically "authenticate before you authenticate" and since you're using a non-forwardable certificate for the authentication, the source (your workstation for instance) is the place where the certificate is. That's where you select the cert from the NLA prompt. If your workstation is part of the same domain (or has a trust to the same domain) as the target server, your workstation already knows that the target server trusts whoever it is that issued you that certificate. In this case however, the workstation has absolutely no knowledge of what the target server's trust store looks like and (for good reason) has no way to determine if the user's certificate is trusted or not.

There is no difference really in NLA and trying to open a UNC path (\\servername.domain.name\sharename) using a smart card for authentication. If the workstation isn't on the same domain or at least can talk to that domain via a trust, it simply does not work.  This isn't a bug. This is how certificate authentication works. The workstation only knows that *IT* trusts that certificate.

There are other reasons not to use NLA as well in non-trusted scenarios like this (source/target computers are not part of a domain or a trust). Even if you're using passwords, there are issues. For instance, there is no way to easily change your password once it has expired. When you open the RDP connection and are presented with the NLA prompt, if your password is expired you simply cannot change it via the NLA prompt.

So why not build a trust or just have all your machines on the same domain?

Because it's a bad idea. Your workstation has access to the internet right? (And please God tell me your servers don't.) That means nasties like keyloggers. Viruses. Trojans. Cannibalism. Mass hysteria. Dogs and cats living together. Basically the worst parts of the bible. The domain where your workstations (and users) are shouldn't be the same domain where your enterprise workloads live. Shouldn't be the same network segment either. Period. Everybody accuses my security posture of being tinfoil-on-the-head... that is, until they become Ebay, JP Morgan Chase, Target, Adobe, Sony, The Home Depot, etc. Folks who haven't been hacked (or don't know they've been hacked) are like teenagers and cars. "Bad stuff won't happen to me, that's somebody else!"

So why use smart cards at all if you have to turn off security features like NLA?

Well, first off. You don't have to turn it off. But I'll get to that in a moment. Second, because the security enhancements you get with two factor auth like a smart card FAR outweigh the protection you get from NLA.

So what do we do? I want NLA and I want to use smart cards!

Have a jump box. Set up a couple of terminal servers and turn off NLA on them. Then set group policy to turn it on everywhere else. When you log on to the terminal server you'll have your smart card credentials available so NLA will work just fine to the other machines in that forest. In fact, do yourself a favor and open your saved RDP file for the terminal server in notepad and add the following line:
enablecredsspsupport:i:0
This turns off NLA attempt on the client side too. It will save you a few seconds on each logon and take you directly to the GINA for that server.

The fact that these servers are now susceptible to the potential denial of service attack, you need to consider your firewall options. What subnets are allowed to open 3389 connections to those servers? How many connections are allowed from any specific IP address on that subnet?

To summarize, here are your options:
<ul>
	<li>Don't use NLA (not a good idea unless it's just a few select servers used as jump boxes).</li>
	<li>Don't use smart card authentication (obviously, you need to be doing this - passwords are so last year, get over it)</li>
	<li>Have all your machines in the same forest (ugh, please don't do this)</li>
	<li>Have a trust between your workstation/user domain and your production enterprise domain (Don't do this either, only trust things you can actually trust. If it's connected to the internet, you can't trust it.)</li>
</ul>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP10, Network Congestion. How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep10-network-congestion-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Sun, 21 Jun 2015 18:23:28 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/06/21/performance-series-ep10-network-congestion-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/dHwKcOGnX-M:0:0]
In episode 10 we&#39;ll talk about network congestion....]]></description>
      <content:encoded><![CDATA[<p style="margin:0in;font-family:Calibri;font-size:11pt;">[View:https://youtu.be/dHwKcOGnX-M:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 10 we&#39;ll talk about network congestion. While the problem isn&#39;t normally on your server, I&#39;ll show you how to determine what caused the issue if it is. This episode also talks about how to spot and identify network latency. We cover perfmon and how to interpret the counters, pathping, TCPView, IO Meter as a network tool, and a handful of other tips and tricks.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP9, Processor Bottlenecks. How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep9-processor-bottlenecks-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Fri, 12 Jun 2015 14:25:03 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/06/12/performance-series-ep9-processor-bottlenecks-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/6qkvYibxots:0:0]
Episode 9, Processor Bottlenecks. Performance Series.

In...]]></description>
      <content:encoded><![CDATA[<p>[View:https://youtu.be/6qkvYibxots:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">Episode 9, Processor Bottlenecks. Performance Series.</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;"></p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 9 we&#39;ll load a machine up to nearly 100% processor utilization and talk about how to track it in perfmon (because I know you already know how to do this with task manager). We also cover context switching, DPC&#39;s, Interrupts, and the Processor Queue Length. After this we cover the process counters and thresholds for tracking down whodunn&#39;it.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP8, Kernel Memory Leaks. How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep8-kernel-memory-leaks-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Fri, 05 Jun 2015 12:16:35 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/06/05/performance-series-ep8-kernel-memory-leaks-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/QmAbdekx9rc:0:0]
In episode 8 we&#39;ll cover how to identify and...]]></description>
      <content:encoded><![CDATA[<p>[View:https://youtu.be/QmAbdekx9rc:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 8 we&#39;ll cover how to identify and troubleshoot memory leaks in the kernel virtual address space. I&#39;ll demo a system crash/lockup and then show what it looks like in perfmon, then expand on how to identify the offending pooltag in the kernel using poolmon.exe. We specifically focus on the nonpaged pool, the paged pool, and system PTE&#39;s as well as the pertinent counters that correlate with thresholds of each &quot;bucket&quot;.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP7, Windows Memory Architecture. How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep7-windows-memory-architecture-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Sun, 31 May 2015 14:36:49 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/05/31/performance-series-ep7-windows-memory-architecture-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/HTblpTHvhjY:0:0]
Episode 7, Windows Memory Architecture. Performance...]]></description>
      <content:encoded><![CDATA[<p style="margin:0in;font-family:Calibri;font-size:11pt;">[View:https://youtu.be/HTblpTHvhjY:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">Episode 7, Windows Memory Architecture. Performance Series.</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">&nbsp;</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 7 we&#39;ll start talking about &quot;Fake Memory&quot; as I&#39;ve been eluding to for several episodes. We cover the microkernel memory architecture of 32 and 64 bit operating systems, the Virtual Memory Manager, and why user mode processes sometimes crash when they exceed it. We cover this in a whiteboarding session and then move into a demo of an actual application crash, and show what a typical crash looks like in Perfmon.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP6, Dude... Where's My RAM? How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep6-who-took-my-ram-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Wed, 27 May 2015 20:01:00 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/05/27/performance-series-ep6-who-took-my-ram-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/v8R1ZQQw0Bg:0:0]
In episode 6 we&#39;ll finish off the RAM and Pagefile...]]></description>
      <content:encoded><![CDATA[<p style="margin:0in;font-family:Calibri;font-size:11pt;">[View:https://youtu.be/v8R1ZQQw0Bg:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 6 we&#39;ll finish off the RAM and Pagefile discussion, then move on to leaks of just RAM. We cover the differences between working set and private bytes counters in the process object. Then we crash our test box again by setting a process lose to go suck up all the Available Mbytes counter and then investigate what that looks like both live and in a capture.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP5, Tracking RAM and Page File Exhaustion: How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep5-tracking-ram-and-page-file-exhaustion-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Fri, 22 May 2015 19:50:44 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/05/22/performance-series-ep5-tracking-ram-and-page-file-exhaustion-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/2O2er22k7wU:0:0]
Episode 5, Tracking RAM and Page File Exhaustion....]]></description>
      <content:encoded><![CDATA[<p>[View:https://youtu.be/2O2er22k7wU:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">Episode 5, Tracking RAM and Page File Exhaustion. Performance Series.</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;"></p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 5 we start the discussion of memory leaks. This is a topic that will span several issues. Memory can mean the virtual address space of a process or the kernel itself, or it could mean you ran out or RAM. Or, you ran out of RAM and Page File. How do you tell which one? How do you figure out which process stole all your precious memory. Specifically in this episode we&#39;ll be talking about what it looks like when you run out of both RAM and Page File (the most common type of process memory leak). We also cover the difference between committed bytes of a process verses private bytes. Finally, we cover concepts like the Virtual Memory Manager of Windows. Trimming of the working set. What the page file really is, etc. The next episode will continue with a discussion more related to the working set.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | Episode 4, Troubleshooting Disk Bottlenecks. Performance Series.</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-episode-4-troubleshooting-disk-bottlenecks-performance-series</link>
      <pubDate>Tue, 19 May 2015 20:20:00 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/05/19/performance-series-episode-4-troubleshooting-disk-bottlenecks-performance-series/</guid>
      <description><![CDATA[[View:https://youtu.be/CWN2SZJr91Q:0:0]
In episode 4 we cover the first of the actual counter sets...]]></description>
      <content:encoded><![CDATA[<p>[View:https://youtu.be/CWN2SZJr91Q:0:0]</p>
<p>In episode 4 we cover the first of the actual counter sets used to identify problems, and the methodology to do so. Identifying a disk bottleneck involves more than just latency counters, it also includes ruling out whether your server or PC was actually the culprit. So what we will do in this episode is load up a computer with a lot of disk activity, then additionally&nbsp;load up the hypervisor that runs that computer and compare the differences. Finally, we will&nbsp;do some&nbsp;process analysis and determine who the bad guy was.</p>]]></content:encoded>
    </item>
    <item>
      <title>Performance Series | EP3, Loading and Interpreting Counters: How IT Pros (SHOULD) Troubleshoot Slow PC's and Servers</title>
      <link>https://docs.microsoft.com/archive/blogs/the_9z_by_chris_davis/performance-series-ep3-loading-and-interpreting-counters-how-it-pros-should-troubleshoot-slow-pcs-and-servers</link>
      <pubDate>Sun, 17 May 2015 10:54:08 GMT</pubDate>
      <dc:creator><![CDATA[BigDaddy9z]]></dc:creator>
      <guid
        isPermaLink="false">https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2015/05/17/performance-series-ep3-loading-and-interpreting-counters-how-it-pros-should-troubleshoot-slow-pcs-and-servers/</guid>
      <description><![CDATA[[View:https://youtu.be/2FKGoz5woTc:0:0]

Episode 3, Loading and Interpreting Counters. Performance...]]></description>
      <content:encoded><![CDATA[<p style="margin:0in;font-family:Calibri;font-size:11pt;">[View:https://youtu.be/2FKGoz5woTc:0:0]</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;"></p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">Episode 3, Loading and Interpreting Counters. Performance Series.</p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;"></p>
<p style="margin:0in;font-family:Calibri;font-size:11pt;">In episode 3 we finish up with the intro to perfmon, such as how to actually load the data collector sets we captured. We then cover some of the basics of interpreting the counters (scaling graphs, scaling counters, looking for patterns, and zooming into the problem).</p>]]></content:encoded>
    </item>
  </channel>
</rss>