With the November 2013 security bulletin release, Microsoft advises that DirectAccess includes a vulnerability that could allow security feature bypass. This update affects all supported versions of Microsoft Windows and addresses an issue with how the DirectAccess server authenticates connections with DirectAccess clients. The vulnerability could be leveraged by an attacker to pose as a man-in-the-middle and intercept their communication. For more details, please review Microsoft Security Advisory 2862152.
Microsoft MVP
Consulting
Pluralsight
Newsletter
All posts in category Windows Server 2008 R2
Vulnerability in DirectAccess Could Allow Security Feature Bypass
Posted by Richard M. Hicks on November 12, 2013
https://directaccess.richardhicks.com/2013/11/12/vulnerability-in-directaccess-could-allow-security-feature-bypass/
Configure Windows Server Core to use PowerShell by Default
Beginning with Windows Server 2012, the core installation mode is now the default and preferred installation mode. For workloads that are supported on Windows Server core, which includes the remote access role and DirectAccess, server core should be used to provide the highest levels of security and availability.
When installing Windows Server 2012/R2 core, the operating system defaults to using the old DOS command prompt. I find this particularly annoying since the majority of administration I do on a server core installation is in PowerShell. Also, most DOS commands can be run from the PowerShell console anyway, so why not have PowerShell as the default shell? Well, that’s easy enough to fix. To begin, at the command prompt enter start powershell.
In the PowerShell window enter the following command:
Set-ItemProperty -Path ‘HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’ -Name Shell -Value PowerShell.exe
Log off the computer and when you log back in, PowerShell will be the default shell! If you need to execute DOS commands that don’t seem to work in PowerShell, simply enter cmd and you’re good to go.
Posted by Richard M. Hicks on September 24, 2013
https://directaccess.richardhicks.com/2013/09/24/configure-windows-server-core-to-use-powershell-by-default/
DirectAccess Computer Certificate Auto-enrollment
DirectAccess requires computer certificates to be installed on the DirectAccess server and DirectAccess clients. These certificates are used for IPsec, which provides a secure, encrypted communication channel between the DirectAccess client and the DirectAccess server. IPsec ensures the necessary integrity, confidentiality, and non-repudiation required for secure remote access. When using a Public Key Infrastructure (PKI) to issue computer certificates to DirectAccess clients, it can be helpful to automate this process by configuring certificate auto-enrollment using Active Directory group policy.
To begin, open the Group Policy Management Console and expand Domains. Next, expand your domain, right-click Group Policy Objects and choose New. Enter a descriptive name for the new GPO and click Ok. Right-click the GPO you just created and choose Edit. Expand Computer Configuration, Windows Settings, Security Settings, and Public Key Policies. Highlight Public Key Policies, and then double-click Certificate Services Client – Auto-Enrollment. For the Configuration Model choose Enabled. It is recommended that you also choose to Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificate templates.
Close out of the Group Policy Editor and then link this computer certificate auto-enrollment GPO to your domain. Target only DirectAccess client and server security groups with this GPO instead of all domain computers by configuring Security Filtering to apply this GPO only to DirectAccess client and server machines.
Finally, on your certificate server, right-click the DirectAccess certificate template, choose Properties, and then choose Security. Make certain the Enroll and Autoenroll permissions are set to Allow for all DirectAccess client and server security groups.
Posted by Richard M. Hicks on August 8, 2013
https://directaccess.richardhicks.com/2013/08/08/directaccess-computer-certificate-auto-enrollment/
Always On VPN Book
DirectAccess Book
Masterclass
Yubikey
