Kerberos Authentication Policies

๐Ÿ”’ Secure Bits ๐Ÿ’ก
๐——๐—ผ ๐—ฌ๐—ผ๐˜‚ ๐—จ๐˜€๐—ฒ ๐—ž๐—ฒ๐—ฟ๐—ฏ๐—ฒ๐—ฟ๐—ผ๐˜€ ๐—”๐˜‚๐˜๐—ต๐—ฒ๐—ป๐˜๐—ถ๐—ฐ๐—ฎ๐˜๐—ถ๐—ผ๐—ป ๐—ฃ๐—ผ๐—น๐—ถ๐—ฐ๐—ถ๐—ฒ๐˜€?

Honestlyโ€ฆ I wonโ€™t blame you if you donโ€™t.
Theyโ€™re powerfulโ€”but ๐—ฟ๐—ฎ๐—ฟ๐—ฒ๐—น๐˜† ๐˜‚๐˜€๐—ฒ๐—ฑ.

๐Ÿง  With Authentication Policies, you can apply granular protection to Kerberos authentication. Think of it as ๐—ฎ๐—ฑ๐˜ƒ๐—ฎ๐—ป๐—ฐ๐—ฒ๐—ฑ ๐—ฐ๐—ผ๐—ป๐˜๐—ฟ๐—ผ๐—นย for how TGTs and TGS tickets are issued.

๐—›๐—ฒ๐—ฟ๐—ฒโ€™๐˜€ ๐˜„๐—ต๐—ฎ๐˜ ๐˜†๐—ผ๐˜‚ ๐—ฐ๐—ฎ๐—ป ๐—ฑ๐—ผ ๐˜„๐—ถ๐˜๐—ต ๐˜๐—ต๐—ฒ๐—บ:
โœ”๏ธ Set ticket lifetimes per-entity (not just globally)
โœ”๏ธ Restrict where an account can request a TGT
โœ”๏ธ Restrict who can request a TGS for a service

โš ๏ธ But let me be clearโ€”this ๐—ถ๐˜€๐—ปโ€™๐˜ ๐—ฎ ๐—น๐—ฒ๐˜ƒ๐—ฒ๐—น ๐Ÿญ control.
To implement it properly, you should already have a ๐—ง๐—ถ๐—ฒ๐—ฟ๐—ถ๐—ป๐—ด ๐— ๐—ผ๐—ฑ๐—ฒ๐—น ๐—ฎ๐—ป๐—ฑ ๐—ฎ๐—ฐ๐—ฐ๐—ฒ๐˜€๐˜€ ๐—ฟ๐—ฒ๐˜€๐˜๐—ฟ๐—ถ๐—ฐ๐˜๐—ถ๐—ผ๐—ป๐˜€ between tiers.

๐—˜๐˜…๐—ฎ๐—บ๐—ฝ๐—น๐—ฒ:
๐Ÿง‘โ€๐Ÿ’ผ T0-Dave (a Tier 0 admin) is only allowed ๐˜๐—ผ ๐—ฟ๐—ฒ๐—พ๐˜‚๐—ฒ๐˜€๐˜ a TGT from T0-Assetsโ€”thanks to the policy.
Try it from anywhere else? Error.
โœ… This controls TGT issuance.

๐—”๐—ป๐—ผ๐˜๐—ต๐—ฒ๐—ฟ ๐—ฐ๐—ฎ๐˜€๐—ฒ:
You restrict access to a file server (share) with TGS to only specific users.
If a Tier 0 admin tries to get a TGS for it?
โŒ Access denied.

The configuration is done through the ๐—”๐—ฐ๐˜๐—ถ๐˜ƒ๐—ฒ ๐——๐—ถ๐—ฟ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ๐˜† ๐—”๐—ฑ๐—บ๐—ถ๐—ป๐—ถ๐˜€๐˜๐—ฟ๐—ฎ๐˜๐—ถ๐˜ƒ๐—ฒ ๐—–๐—ฒ๐—ป๐˜๐—ฒ๐—ฟ.

๐—ฌ๐—ผ๐˜‚ ๐—บ๐—ถ๐—ด๐—ต๐˜ ๐—ฎ๐˜€๐—ธ:
โ€œBut donโ€™t I get similar results from just using access restrictions in a Tiering Model?โ€

Kind of. But hereโ€™s the difference:
๐Ÿ“Œ Tiering restrictions stop you ๐—ณ๐—ฟ๐—ผ๐—บ ๐˜‚๐˜€๐—ถ๐—ป๐—ด ๐˜๐—ต๐—ฒ ๐˜๐—ถ๐—ฐ๐—ธ๐—ฒ๐˜.
๐Ÿ“Œ Authentication Policies stop you ๐—ณ๐—ฟ๐—ผ๐—บ ๐—ฒ๐˜ƒ๐—ฒ๐—ป ๐—ด๐—ฒ๐˜๐˜๐—ถ๐—ป๐—ด ๐˜๐—ต๐—ฒ ๐˜๐—ถ๐—ฐ๐—ธ๐—ฒ๐˜.
See the distinction?

Make sure to use the ๐—ฎ๐˜‚๐—ฑ๐—ถ๐˜ ๐—ณ๐—ฒ๐—ฎ๐˜๐˜‚๐—ฟ๐—ฒ, you can easily lock yourself out.

๐Ÿ” I go through this in my ๐—ณ๐˜‚๐—น๐—น ๐—ณ๐—น๐—ฎ๐—ด๐˜€๐—ต๐—ถ๐—ฝ ๐—ฐ๐—ผ๐˜‚๐—ฟ๐˜€๐—ฒ: Windows Infrastructure Security (WIS).

There are also Authentication Policy Silos, but we will discover them another day.

๐—•๐˜‚๐˜ ๐—œโ€™๐—บ ๐—ฐ๐˜‚๐—ฟ๐—ถ๐—ผ๐˜‚๐˜€โ€ฆ
Have you ever used Authentication Policies in production?
How did it go?