search

lithnet / access-manager

Access Manager provides web-based access to local admin (LAPS) passwords, BitLocker recovery keys, and just-in-time administrative access to Windows computers in a modern, secure, and user-friendly way.
Other
241 stars 20 forks source link

Add other domains to LAM #246

Open milanbla opened 3 weeks ago

milanbla commented 3 weeks ago

Manage LAPS of other domains. We have installed Lithnet Access Manager on a server in domain (A) during the testing phase, where Windows LAPS is deployed. Everything seems functional. We would like to manage the passwords of servers from other domains as well. These are domains that have a one-way, non-transitive trust towards domain (A). I attempted to set up management with domain (B), which uses legacy Microsoft LAPS. I added the Lithnet service account from domain (A) to the following groups in domain (B): • Windows Authorization Access • Access Control Assistance Operators • Pre-Windows 2000 Compatible Access Additionally, I ran the 'Delegate LAPS Permissions' script in domain (B), which is provided by LAMS under the Active Directory\Microsoft LAPS tab. The script successfully delegated security permissions for the Lithnet service account. The good news is that other domains are visible in the Authorization rules\Computers tab in LAMS and can be browsed. I was hopeful that domain (B) would appear in the Directory Configuration\Active Directory tab. Unfortunately, it did not appear. I also tried importing authorization rules from OUs of the domain (B), but the discovery ended with the error: "The object (SID) was not found in the global catalog." My question is: Is it possible to deploy LAM in the configuration I described, meaning a single LAMS server managing the existing domain (A) while also administering other trusted domains that are not in the same forest as domain (A)?

Thank you in advance for your reply

ryannewington commented 3 weeks ago

@milanbla yes it is supported to install AMS in domain (A) and access passwords in domain (B), provided there is at least a one-way trust that B trusts A.

Could you attach your UI log file, after browsing to the "Directory Configuration/Active Directory" tab, so we can see why its not appearing. Also perform an import as well so we can capture the details of the problem.

The log will be at C:\Program Files\Lithnet\Access Manager Service\logs\access-manager-ui.log

milanbla commented 3 weeks ago

Hi, Thank you for your response, I am attaching the UI log file. For security reasons, I have renamed the objects of the individual domains and similar items.

access-manager-ui.log

ryannewington commented 2 weeks ago

Thanks for providing the log @milanbla

I'm having trouble reproducing this issue in our lab. Can you tell me a bit more about the topology between the two forests? What type of trust is it? Is it a one-way forest transitive trust like extdev in the image below, or something else?

image

The problem is that we're asking your local DC to tell us what DNS name we should be talking to for the remote forest and it doesn't know.

milanbla commented 2 weeks ago

The trust is external because, as I mentioned before, these are domains that are not in the same forest. image

ryannewington commented 1 week ago

Sorry for the delay @milanbla - we've been quite busy here.

I don't have any answers yet, as we don't have this trust type set up in our labs. There's obviously some limitation with GC lookups in this scenario that prevents it from working as-is with an external trust.

It might take some time to work out what is going on here. Is this a blocking issue for you?

Is it only permission imports that are not working? Can you access passwords and everything else ok?

milanbla commented 1 week ago

Thank you for your response.

This is a problem for us, as we intended to manage passwords across all trusted domains as well as the Linux environment. We have purchased Lithnet licenses for testing until the end of this year, and our decision to proceed with the project depends on the results.

Access to passwords works only in the newly created domain (Domain A), which has just a few servers. Unfortunately, we cannot access the passwords of the other two domains (with thousands of servers) that have an external trust with Domain A.

ryannewington commented 1 week ago

@milanbla If you are an existing customer you have access to our enterprise support channels - do you want to reach out to your account manager and we can get this prioritized and associated with your account?

milanbla commented 1 week ago

Yes, that would be ideal. (I am registered here on GitHub with my personal account)

ryannewington commented 6 days ago

Reach out to us here so we have your business contact details and we'll get you onboarded to our enterprise support tool

https://lithnet.io/contact-us