search

PowerShell / PSDscResources

MIT License
129 stars 53 forks source link

MSFT_GroupResource: SAMR can be blocked by domain controller GPO in Get-TargetResource #206

Open tylerdums opened 2 years ago

tylerdums commented 2 years ago

Details of the scenario you tried and the problem that is occurring

when we use this module, we found it’s blocked by following group policy, which somehow is set on domain controller.

Network access - Restrict clients allowed to make remote calls to SAM - Windows security | Microsoft Docs.

error at function Get-TargetResource in file MSFT_GroupResource.psm1

Verbose logs showing the problem

image

Network trace shows the SAMR connection failed with status 0x5 which means “Access Denied”. Also it shows the computer account is used. So when the GPO "Restrict clients allowed to make remote calls to SAM" is set on domain controller and not allowing computer account, this DSC command fails when it use function Get-TargetResource.

Suggested solution to the issue

It’s possible some domain admins following CIS recommendation to set it that way – See following picture, althought CIS actually only recommends the “member server” not domain controller. Would you please consider to change the code from using SAMR to LDAP protocol which won’t be impacted by the GPO? image

The DSC configuration that is used to reproduce the issue (as detailed as possible)

We firstly configure a group in Administrators image It runs successfully. Secondly, add another group, it shows the error. image image

The operating system the target node is running

image

Version and build of PowerShell the target node is running

image

Version of the DSC module that was used ('dev' if using current dev branch)

Not exactly sure, but should be the official version, not dev.

tylerdums commented 2 years ago

We have done some further research and think the issue is when Find-Principal uses .net System.DirectoryServices.AccountManagement, which could by design use SAMR (RPC call to SAM), which can potentially get blocked, when domain controller has configured network-access-restrict-clients-allowed-to-make-remote-sam-calls. We have asked our AD admin to set per Microsoft default value. For long term, if Find-Principal uses other mechanism which leverage LDAP/Kerberos call instead of SAMR, this issue can be bypassed. It's possible any domain admin wants to restrict SAMR read permission or security admin wants to block RPC against SAM. To make this DSC module work with the group policy, it needs exemption of all domain member machines, which may raise some security concern.