Open tylerdums opened 2 years ago
We have done some further research and think the issue is when Find-Principal uses .net System.DirectoryServices.AccountManagement, which could by design use SAMR (RPC call to SAM), which can potentially get blocked, when domain controller has configured network-access-restrict-clients-allowed-to-make-remote-sam-calls. We have asked our AD admin to set per Microsoft default value. For long term, if Find-Principal uses other mechanism which leverage LDAP/Kerberos call instead of SAMR, this issue can be bypassed. It's possible any domain admin wants to restrict SAMR read permission or security admin wants to block RPC against SAM. To make this DSC module work with the group policy, it needs exemption of all domain member machines, which may raise some security concern.
Details of the scenario you tried and the problem that is occurring
when we use this module, we found it’s blocked by following group policy, which somehow is set on domain controller.
Network access - Restrict clients allowed to make remote calls to SAM - Windows security | Microsoft Docs.
error at function Get-TargetResource in file MSFT_GroupResource.psm1
Verbose logs showing the problem
Network trace shows the SAMR connection failed with status 0x5 which means “Access Denied”. Also it shows the computer account is used. So when the GPO "Restrict clients allowed to make remote calls to SAM" is set on domain controller and not allowing computer account, this DSC command fails when it use function Get-TargetResource.
Suggested solution to the issue
It’s possible some domain admins following CIS recommendation to set it that way – See following picture, althought CIS actually only recommends the “member server” not domain controller. Would you please consider to change the code from using SAMR to LDAP protocol which won’t be impacted by the GPO?![image](https://user-images.githubusercontent.com/89135801/170729590-1897661e-8d0a-4f39-967c-423d6d3db90a.png)
The DSC configuration that is used to reproduce the issue (as detailed as possible)
We firstly configure a group in Administrators
It runs successfully.
Secondly, add another group, it shows the error.
![image](https://user-images.githubusercontent.com/89135801/170734191-7f445dc0-788b-4219-87ec-94a5dde73c2d.png)
The operating system the target node is running
Version and build of PowerShell the target node is running
Version of the DSC module that was used ('dev' if using current dev branch)
Not exactly sure, but should be the official version, not dev.