NPS Extension for MFA – All you need to know

NPS extension for MFA helps to make use of Azure MFA for on VPN connectivity.  Although the documentation from Microsoft is straight forward to explain how that work and how to configure, we don’t have much information online.

Let’s assume that you have a Radius server as

  1. Lab-DCRadius.
  2. Cisco-Asa

console1

 

  • I have configured Cisoco-ASA to use lab-DCRadius. On NPS server, I have configured CiscoASA as Radius client to access connection
  • Test the VPN using Cisco AnyConnect to LabVPN.Lab.com

From the following diagram, illustrate the flow.  (The above said registry keys play the role of transferring the secondary Auth to Azure MFA)

flow

Once you confirm that VPN is working,

Install the NPS extension from here, there are 2 version 1.0.1.16 & 1.0.1.20 (1.0.1.21 is available but on request to Microsoft)

To make sure Azure MFA accept the request from the NPS server,

Once you install it you have to run the script that comes with the NPS extension

  • Run Windows PowerShell as an administrator.
  • Change directories.
  • cd “C:\Program Files\Microsoft\AzureMfa\Config”
  • Run the PowerShell script created by the installer.

.\AzureMfaNpsExtnConfigSetup.ps1

  • Sign in to Azure AD as an administrator.
  • PowerShell prompts for your tenant ID. Use the Directory ID GUID that you copied from the Azure portal in the prerequisites section.
  • PowerShell shows a success message when the script is finished.

 

What this does is it

  1. Sets the registry with a some values
  2. Creates a self-signed certificate on your server and uploade the certificate on Azure.

To verify check the following registry key

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa

tempsnip

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\

reg

To verify the certificate,

Local Certificate

  1. Open MMC -> File- > Add/Remove Snap-in-> Certificate -> Local Computer, Click Ok
  2. Navigate to Certificates -> Personal – >Certificates

You will find a certificate with the tenant Id.

  1. Go to the properties of the certificate, under details tab, look for Thumbprint, Copy it somewhere.
  2. Now open Azure module for Windows PowerShell
  3. Run the command in the screenshot

msol

  1. Copy the value in to a notepad and save it as .cer (if you have more than one cert, you might see more values. You have to copy each one of them in to a separate file and save it as .cer)
  2. Now open the save .cer file.
  3. Now under details tab, look for Thumbprint property.

Computer these 2 thumbprint and make sure they matches.

Gotchas

  1. What if registration fails – This usually happens either if your AD account doesn’t have access to local certificate store or Azure portal (GA admin is the requirement to upload the cert)
  2. How do I disable MFA on one of the NPS server to test it?
  • You can disable the MFA on NPS server.  This is essential to find out when you are troubleshooting to narrow down which NPS server is having the issue. To disable the MFA on a NPS server without de-registering it,
  • Navigate to the registry key, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serevice\AuthSrv\Parameters, Empty the following key values
    • AuthorizationDLLs
    • ExtentionDLL
  • This will stop the NPS to look for Secondary Auth
  1. How to renew the certificate when it expires
  • The certificate usually has 2 years of validity.  You can renew it by simply running AzureMfaNpsExtnConfigSetup.PS1

Known issue.

Recently, I have seen the ver. 1.0.1.20 is causing performance issue.  There is a newer version which fixes the problem 1.0.1.21.

Microsoft Intune – Things to remember before you use new Azure integrated Intune

As you may already know that Microsoft decided and moved from Classic Intune to Azure integrated Intune.  There are few things that needs to considered before you decide to use Azure integrated Intune for patch management.

  • The app groups that are created in Classic intune are being migrated to Azure integrated Intune.  These groups cannot be used in Classic intune anymore.  If you would like to patch the workstations with the existing group or create a new groups, it wont work – Microsoft acknowledged this as bug and awaiting resolution (This has been resolved now)
  • If there is a policy that exists in the Classic portal and you are using Azure integrated intune, and has a software update ring, then there might be a policy conflict.  Make sure the Classic Intune are removed.
  • Classic Intune can only manage the devices using Intune management agent.  Azure integrated Intune can manage the devices only if the device is enrolled as Mobile Device.  If the agent is present in the workstations, it cant be enrolled as mobile device.  So first thing you should do is to remove the Agent.
  • If the Agent is present in the workstation it cant be enrolled to new Azure integrated Intune.  You have to uninstall the agent, you can use https://gallery.technet.microsoft.com/Uninstall-the-Intune-b42111d1.  This will create a Schedule Tasks.  It may take about 5 to 10 mins.  It uses ProvisioningUtil.exe located under C:\Program Files\Microsoft\OnlineManagement\Common.  If you have custom installation path or if the exe doesn’t exist, then you might need to install the Agent again and run this script again.
  • If you are planning to migrate to Azure integrated Intune from Classic Intune, make sure the device is not listed in the Classic portal.  If the device is visible, then before enrolling, make sure the workstation entry is removed from the Classic portal.  Sometimes you may see entries in both the portal, In that case, you have to remove the device from both the portal, and re-enroll.
  • Finally, version upgrade of windows 10 is not straight forward.

Hope this helps

VJ

Spectre – Vulnerabilities

Recently Google Project Zero team has identified a vulnerabilities on CPU that is affecting all AMD, Intel and ARM Processors.

The variants of the issue identified so far,

Variant 1: bounds check bypass (CVE-2017-5753)
Variant 2: branch target injection (CVE-2017-5715)
Variant 3: rogue data cache load (CVE-2017-5754)

The entire Azure / Office 365 platform from Microsoft is being patched and rebooted as a matter of priority to resolve this problem.  You might have already got notification to do a redeploy at your convenience or MS would have forced it last week.

To take care of the on-prem infrastructure, MS has released patches

https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution

No patches will be available for Windows XP, Vista, 2000, 2003 etc.

These patches only mitigate the exposure of vulnerability but not resolve.  You MUST update your infrastructure as soon as possible and also check for any manufacture update like BIOS or driver updates

*Google Chrome, IE, Firefox also got some updates last week to handle this vulnerabilities.

Hope this information was useful.

VJ