Hello everyone. In today’s article I’ll cover a very interesting AD FS feature that helps protect domain accounts from attacks such as “password spray” using AD FS Extranet lockout. This feature is called AD FS Extranet Smart Lockout.
Topics covered in today’s article
In today’s article, we’ll cover the following topics and tasks:
- What is AD FS Extranet Lockout
- What is Extranet Smart Lockout
- Best practices for configuring password policies
- How to configure the password policy on the on-premises AD
- How to enable and configure AD FS Extranet Lockout
- How to configure AD FS Extranet Smart Lockout
- How to monitor user activity
What is AD FS Extranet Lockout
Extranet lockout, or soft lockout, was introduced in the AD FS service on Windows Server 2012 R2 operating systems. This feature was created to block successive malicious authentications from outside the organization attempting access using brute force or a password guessing attack. These categories of attacks cause account lockouts on the on-premises AD, causing disruption to users and organizations.
What is Extranet Smart Lockout
ESL, or Extranet Smart Lockout, is the evolution of Extranet Lockout and is available starting with the AD FS service installed on Windows Server 2016 and later operating systems. With this feature, the AD FS service stores the locations from which each user has made one or more valid sign-ins, and it can tell apart an access attempt made by the credential owner using an invalid password from an attack made against that account.
Best practices for configuring password policies
AD FS Extranet Lockout policies work independently of the on-premises AD lockout policy, but it is highly recommended to set the invalid password threshold lower than the one defined on the on-premises AD, and the counter reset time higher than the one defined on the on-premises AD. Example:
Number of invalid sign-in attempts on AD FS: 3 attempts
Counter reset time on AD FS: 40 minutes
Number of invalid sign-in attempts on AD: 6 attempts
Counter reset time on AD: 30 minutes
With the configuration above, if an external attack occurs against a credential, external access is blocked after the third attempt, and any attempt with a valid or invalid password is blocked for 40 minutes. Since the on-premises AD access policy has a threshold of up to 6 invalid attempts, the account is not locked out on AD.
Note: There are cases where the user signs in to AD FS from the internal network, leading administrators to believe there’s some issue with the AD FS policy. This scenario can easily be identified through user account monitoring, which we’ll cover in the last topic of this article.
Configuring the lockout policy on the on-premises AD
As the first step in our demonstration, let’s create the account lockout policy on the on-premises AD by following the steps below:
1 – On the domain controller server, let’s change the default policy available under Group Policy Management > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.
2 – Let’s change the Account lockout threshold parameter to 6. After applying this change, we’re given a suggested lockout duration and automatic reset time of 30 minutes.
Configuring AD FS Extranet Lockout
With the lockout policy created on the on-premises AD, let’s enable and set the invalid password control metrics on AD FS following the best practice defined in the previous topics. Let’s run the command below on the primary AD FS server:
Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 3 -ExtranetObservationWindow (new-timespan -Minutes 40)
Let’s confirm the policy settings by running the command below:
Get-AdfsProperties
Configuring AD FS Extranet Smart Lockout
On a Windows 2016 server, the updates released in June 2018 are required, and the Farm level must be 2016 for this feature to be used. The Windows Remote Management service must be active on all AD FS servers.
To use ESL on Windows Server 2016 servers, you need to update the Artifact database in AD FS, including the AdfsArtifactStore.AccountActivity table. Let’s run the commands below to configure the database permissions and to create the table:
1 – Let’s paste the command below into PowerShell ISE to make it easier to run more than one command line.
2 – Let’s sign in with a user that has administrator permissions on the AD FS service.
3 – Let’s enter the password.
4 – Click OK to save the credentials.
$cred = Get-Credential Update-AdfsArtifactDatabasePermission -Credential $cred
The commands below make the table and permission changes in the AD FS database.
# when prompted with “Are you sure you want to perform this action?”, enter Y.
[CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact = 'High')]
Param()
$fileLocation = "$env:windir\ADFS\Microsoft.IdentityServer.Servicehost.exe.config"
if (-not [System.IO.File]::Exists($fileLocation))
{
write-error "Unable to open ADFS configuration file."
return
}
$doc = new-object Xml
$doc.Load($fileLocation)
$connString = $doc.configuration.'microsoft.identityServer.service'.policystore.connectionString
$connString = $connString -replace "Initial Catalog=AdfsConfigurationV[0-9]*", "Initial Catalog=AdfsArtifactStore"
if ($PSCmdlet.ShouldProcess($connString, "Executing SQL command sp_addrolemember 'db_owner', 'db_genevaservice' "))
{
$cli = new-object System.Data.SqlClient.SqlConnection
$cli.ConnectionString = $connString
$cli.Open()
try
{
$cmd = new-object System.Data.SqlClient.SqlCommand
$cmd.CommandText = "sp_addrolemember 'db_owner', 'db_genevaservice'"
$cmd.Connection = $cli
$rowsAffected = $cmd.ExecuteNonQuery()
if ( -1 -eq $rowsAffected )
{
write-host "Success"
}
}
finally
{
$cli.CLose()
}
}
After running the script above, confirm by clicking Yes to All.
More information about the steps above can be found in the official Microsoft documentation through this link.
Monitoring user activity
The user activity monitoring feature helps administrators identify the reason behind an access lockout to the service. To collect activity information for an account, let’s run the command below on AD FS:
Get-ADFSAccountActivity otto@ulyneves.com
We can see two parameters that let us identify whether there was any external access attempt with an invalid password from a known or unknown location: BadpwdCountFamiliar and BadpwdCountUnknown.
In the FamiliarIps attribute, we can identify the external IPs from which the user Otto has already successfully signed in. These IP addresses allow the location to be classified as familiar on AD FS.
As a test, let’s deliberately enter the invalid password for user otto@ulyneves.com in the AD FS portal.
We can see below that the counter stopped incrementing at the third attempt, as configured in the ESL policy. We can also see it was classified as familiar, since I ran the test from a location where a sign-in had previously succeeded.
With the counter below at 3, even with a valid password, my access was blocked for 40 minutes and will be reset to zero after this period.
We confirmed on the on-premises AD that the user Otto has the badPwdCount attribute with a value of 3, which confirms the number of attempts made by AD FS on the PDC to validate the credentials provided during the test.
With the test above, we were able to confirm that, by following the best practices defined by Microsoft, it is possible to protect on-premises AD credentials from attacks originating outside the organization.
If the user needs to access externally and cannot wait for the automatic reset time, it’s possible to reset the BadpwdCountFamiliar attribute with the command below:
Reset-ADFSAccountLockout otto@ulyneves.com -Location Familiar
Once the reset is done and with valid credentials in hand, access for the user Otto@ulyneves.com is allowed in the application.
Summary
In today’s article, we explained how to protect on-premises AD accounts using invalid password control policies and demonstrated how to configure the Extranet Smart Lockout feature available in AD FS versions 2019 and 2016.
I hope this content has contributed to enriching your knowledge of Azure AD FS.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, let us know.
[ ]’s
Ulysses Neves
