New T-TGTDelegation rule logic is naive about pingcastle HOT 9 CLOSED

@dirkjanm: That's high praise given how many of your excellent blog posts I've read. Thanks!

As for documentation, not beyond the official (but incomplete) published ones:

• KB4490425: Updates to TGT delegation across incoming trusts in Windows Server
• Changes to Ticket-Granting Ticket (TGT) Delegation Across Trusts in Windows Server (PFE edition)
• [MS-ADTS]: trustAttributes

The catalyst for heading down this rabbit hole was PingCastle reporting my lab environment as vulnerable to cross-forest TGT delegation in contrast to Microsoft's published docs on the change in default behaviour as of the July 2019 security updates. Figuring out what was really happening was further compounded by netdom giving me mixed messages, PowerShell's ActiveDirectory module outright lying to me, and the undocumented (and I assume new) CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION flag I ended up discovering. The results above are effectively the summary of my testing and some reverse engineering when I started digging in to it yesterday :)

from pingcastle.

New reply available in the thread I opened in the open specification forum.

from pingcastle.

Thanks @ralish
Program updated!
Feel free to leave any comments

from pingcastle.

Thanks for the feedback.
While working for it, I've requested an official feedback (because other users will ask me for references ...)
Here it is: https://social.msdn.microsoft.com/Forums/en-US/385d30ad-acf5-4fe6-ab5d-1ab01bb0f37f/msadts-61679-trustattributes?forum=os_windowsprotocols

from pingcastle.

@vletoux Sounds good. You can see the 0x800 bit set when you enable TGT delegation with netdom on a patched system. The symbolic reference is displayed in ADUC and ADSI when viewing the trustAttributes attribute in the Attribute Editor. It's also referenced in ldp.exe.

from pingcastle.

Thanks for the detailed analysis of this! Was a great read. I had a short discussion about it with Vincent and we both couldn't really figure out how the change actually worked. Out of curiosity, do you have any official or unofficial sources for this information?

from pingcastle.

You can see the change in kdcsvc : KdcGetTicketInfoForDomain:

Before (10.0.17763.1):

After (10.0.17763.615):

from pingcastle.

Just a heads-up that it looks like MSFT may have fixed the netdom.exe issue per my write-up in the latest cumulative updates. For example see KB4519979:

Addresses an issue that prevents netdom.exe from displaying the new ticket-granting ticket (TGT) delegation bit for the display or query mode.

from pingcastle.

Excellent

from pingcastle.