{"id":7007,"date":"2023-02-25T10:44:54","date_gmt":"2023-02-25T14:44:54","guid":{"rendered":"https:\/\/kevinjustin.com\/blog\/?p=7007"},"modified":"2023-03-07T13:51:36","modified_gmt":"2023-03-07T17:51:36","slug":"check-your-delegation-settings-to-avoid-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/kevinjustin.com\/blog\/2023\/02\/25\/check-your-delegation-settings-to-avoid-security-vulnerabilities\/","title":{"rendered":"Check your delegation settings"},"content":{"rendered":"

\"\"<\/a><\/p>\n

 <\/p>\n

<\/h1>\n

Sometimes as the monitoring admin, you may be responsible to secure your servers, being told from Security\/Cyber Teams about new vulnerabilities.\u00a0 The vulnerabilities may be from Tanium, ACAS, Tenable or other security tools.\u00a0 \u00a0This article is how to help you secure related SCOM web console, and SSRS reporting sites against Unconstrained Delegation vulnerabilities CVE-2020-17049<\/a>, also AD STIG V-36435.<\/a><\/p>\n

 <\/p>\n

First we need to identify IF this is a true finding.<\/p>\n

Typically this comes from Server\/SystemsAdmin with domain admin access:<\/p>\n

From PowerShell run:<\/p>\n

Get-ADComputer -LDAPFilter<\/span>
\n“(userAccountControl:1.2.840.113556.1.4.803:=524288)”<\/span><\/p>\n

After identifying SCOM servers with unconstrained delegation (scope of blog post is focused on SCOM in a hybrid scenario (prem\/cloud), we need to resolve.<\/p>\n

With domain administrator rights, open the Active Directory Users and Computers MMC snap-in.<\/p>\n

In ADUC, change Find drop-down to Computers
\nIn the Computer name text box, enter <SCOMServer>\u00a0 and click search<\/p>\n

Right click the server in the results box > Select Properties.<\/p>\n

Select the Delegation tab.<\/p>\n

\"\"<\/a>
ADUC view of lab server delegation setting<\/figcaption><\/figure>\n

 <\/p>\n

Select Trust this computer for delegation to specified services only > Use any authentication protocol.<\/p>\n

Under Services to which this account can present delegated credentials, select Add.<\/p>\n

In the new dialog box, select Users or Computers.<\/p>\n

Enter <SCOMServer>, and then select OK.<\/p>\n

Click the Add button to add services<\/p>\n

Select the w3svc and www processes<\/p>\n

Select OK.<\/p>\n

\"\"<\/a>
ADUC GUI adding services for delegation on SCOM server<\/figcaption><\/figure>\n

Once set in AD, reboot server.\u00a0 Running ‘gpupdate \/force’ may not apply AD changes to the server object.<\/p>\n

After reboot, reach out to SCOM Admins to test webconsole authentication<\/p>\n

From edge browser, go to SCOM web console, typically @ https:\/\/<SCOMServer>\/OperationsManager<\/p>\n

On the Monitoring tab, click on Active Directory dashboard on left<\/p>\n

Verify authentication works<\/p>\n

 <\/p>\n

Documentation<\/strong><\/p>\n

Pentestlab – Detecting Unconstrained Delegation Exposures in AD Environment<\/a><\/p>\n

Petri.com find and block unconstrained delegation<\/a><\/p>\n

Learn.Microsoft.com unconstrained kerberos article<\/a><\/p>\n

Explanatory documents on what\/why<\/p>\n

Remove Unconstrained Kerberos Delegation<\/a><\/p><\/blockquote>\n