KB000007: Adding JIT groups via Group Policy doesn't work with NTLM Disabled
PreviousKB000006: Migrating the Access Manager DatabaseNextKB000008: AMS is unable to JIT into privileged groups such as Domain Admins
Last updated
Was this helpful?
Last updated
Was this helpful?
When NTLM is restricted (specifically, outgoing NTLM) on a workstation or server, JIT groups added via Group Policy may not apply correctly.
NTLM is often disabled on Windows using the following Group Policy settings found in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options:
Network security: Restrict NTLM: Incoming NTLM traffic – "Deny All Accounts"
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers – "Deny All"
Another Group Policy setting, , is known to cause issues when NTLM is restricted: "Enable RPC Endpoint Mapper Client Authentication"
At the time of writing (August 2023), Microsoft documentation these two settings are incompatible.
To quote Microsoft's :
It's encouraged to move away from NTLM to better secure your environment. If faced with a choice between restricting NTLM and using
EnableAuthEpResolution, the recommended approach is that you restrict NTLM in your environment.
Once RPC Endpoint Mapper Client Authentication (EnableAuthEpResolution) is disabled, groups should sucessfully apply using Group Policy after a reboot.
When making changes to Local Users and Groups via GPO, Windows needs to be aware of the security identifier (SID) of the group.
Typically, when a group is added to a local group on a computer via GPO, the SID is precomputed, as the exact group to be added is already known. However, when the name of the group contains a variable - such as %computername% - SIDs are not pre-computed in the policy (as the group name will depend on the machine itself).
However, when EnableAuthEpResolution is enabled, the RPC Endpoint Mapper Client will use NTLMSSP to authenticate to the Endpoint Mapper Service on the domain controller. As NTLM is disabled on the client, this connection fails!
This authentication failure means that the resolution of the group name fails. As a result, the group is never added to the local group on the workstation or server.
As a result, Windows uses the function from ntsecapi.h to transform security group names (e.g. DOMAIN\Group) into security identifiers (SIDs) on the client.
The first part of this process is for the client to connect to a domain controller and call Endpoint Mapper (TCP 135). This allows the client to identify the port on which to connect to the service.