All posts tagged DA

November 2024 Microsoft Security Updates and DirectAccess

With the November 2024 security updates, Microsoft disclosed a vulnerability (CVE-2024-43639) in the Windows Server KDC Proxy service. This is a Remote Code Execution (RCE) vulnerability with a max severity rating of Critical. If you still use Microsoft DirectAccess for remote access, you’ll want to pay close attention to this bulletin.

KDC Proxy and DirectAccess

When DirectAccess is installed and configured, the KDC Proxy Service is enabled automatically and by default. By design, DirectAccess servers are exposed to the Internet, which significantly increases the risk of this vulnerability. Organizations that have deployed DirectAccess are encouraged to update their systems immediately.

Workaround

There is no known workaround available at this time. Apply the latest security updates to mitigate this risk.

Additional Information

Windows KDC Proxy Remote Code Execution Vulnerability

Microsoft DirectAccess Formally Deprecated

Leave a comment
by Richard M. Hicks on November 14, 2024  •  Permalink
Posted in Active Directory, authentication, CVE, DirectAccess, Enterprise, Infrastructure, KDC Proxy, Microsoft, Operational Support, Remote Access, Security, Security Update, Update, Vulnerability
Tagged , , , , , , , , , , , ,

Posted by Richard M. Hicks on November 14, 2024

https://directaccess.richardhicks.com/2024/11/14/november-2024-microsoft-security-updates-and-directaccess/

System Center Operations Manager 2012 Monitoring Pack for Windows Server 2012 Remote Access

Microsoft recently released a Monitoring Pack for System Center Operations Manager 2012 specifically targets the Remote Access role in Windows Server 2012. With this new monitoring pack, a systems management engineer can monitor a Windows Server 2012 server with the remote access role installed for the following conditions:

DirectAccess

  • Network interface connection and settings issues
  • IPv6 transition protocol configuration
  • DoS, spoof, and replay attack heuristics
  • IPsec state
  • DNS and management server configuration
  • Underlying service status
  • OTP-related heuristics

Remote Access and Site-to-Site VPN

  • Connection failures
  • Improper configuration
  • Hardware device and IPsec related failures
  • Monitoring of performance counters and instrumentation

This management pack leverages PowerShell cmdlets such as Get-RemoteAccess, Get-DAMultisite, and Get-RemoteAccessHealth. As such, only Windows Server 2012 is supported by this management pack. You can download the System Center Operations Manager 2012 Monitoring Pack for the Windows Server 2102 Remote Access role here.

8 Comments
by Richard M. Hicks on January 31, 2013  •  Permalink
Posted in Important Links, Remote Access, Windows Server 2012
Tagged , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on January 31, 2013

https://directaccess.richardhicks.com/2013/01/31/system-center-operations-manager-2012-monitoring-pack-for-windows-server-2012-remote-access/