Hello everyone. In this article, I will cover one common issue when moving from WHfB Certificate trust to WHfB Cloud Kerberos Trust. If you are planning to migrate from WHfB Certificate trust to WHfB Cloud Kerberos trust, most probably, you are following this document: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision?tabs=intune#migrate-from-certificate-trust-deployment-model-to-cloud-kerberos-trust
Scenario: WHfB Hybrid Cert Trust to Cloud Kerberos Trust migration
Device join type: Hybrid Azure Ad Joined
In case the deployment is being done via GPO, the settings below should be enabled to cover the computer objects:
With the policy above configured, looking into the Microsoft-Windows-User Device Registration/Admin event viewer logs and filtering by event ID 358, we find out that the setting Cloud trust for on premise auth policy is enabled is set to No, which means that no WHfB Cloud Kerberos trust will be provisioned.
Windows Hello for Business provisioning will be launched.
Device is AAD joined ( AADJ or DJ++ ): Yes
User has logged on with AAD credentials: Yes
Windows Hello for Business policy is enabled: Yes
Windows Hello for Business post-logon provisioning is enabled: Yes
Local computer meets Windows hello for business hardware requirements: Yes
User is not connected to the machine via Remote Desktop: Yes
User certificate for on premise auth policy is enabled: Yes
Machine is governed by enrollment authority policy.
Cloud trust for on premise auth policy is enabled: No
User account has Cloud TGT: Not Tested
See https://go.microsoft.com/fwlink/?linkid=832647 for more details.
Checking the Microsoft-Windows-User Device Registration/Debug event viewer logs and filtering by event IDs 500 and 503, we find detailed steps during Ngc policy check:
NgcPolicy::IsDeviceStateReadyCore started
NgcPolicyCheck: FailFast is set to TRUE
NgcPolicyCheck: { NgcPolicy::VerifySessionIsNotRemote } stage succeeded
NgcPolicyCheck: { NgcPolicy::GetUserAccountType } User type is DJ++ and user has a PRT ( domain join + AAD Join )
NgcPolicyCheck: { NgcPolicy::VerifyPrimaryAccountHasPrt } stage succeeded
NgcPolicyCheck: { NgcPolicy::VerifyDeviceIsJoined } stage succeeded { device is joined }
NgcPolicyCheck: { NgcPolicy::GetNgcPolicyState } Platform policy returned by NgcQueryEnabled. NgcEnabledState = 1 (NgcEnabled), NgcPolicySource = group policy, NgcPolicyModifiers = certificate is required for on-prem auth, ProvisioningSuccessExpected = TRUE
NgcPolicyCheck: { NgcPolicy::VerifyNgcIsEnabled } stage succeeded { NGC policy is NgcEnabled }
NgcPolicy::VerifyAccountHasCloudTgt – hr: 0x00000000. UseCloudTrustForOnPremAuth = No, CertificateRequiredForOnPremise = Yes, AccountHasCloudTgt = Not Tested, CloudTgtPresent = FALSE.
NgcPolicyCheck: { NgcPolicy::VerifyMachineMeetsNgcRequirements } stage succeeded { provisioning is expected to succeed on this machine }
With the events above, we can see that Certificate Trust configuration is still enabled. As per event ID 6441 in the Microsoft-Windows-HelloForBusiness/Operational logs result, we confirm that Windows Hello for Business certificate trust and cloud trust policies are both enabled. Certificate trust policy will be enforced.
Troubleshooting:
Running RSOP command on cmd, we find the conflicting policies configured below:
If the Use certificate for on-premises authentication policy is enabled, certificate trust will take precedence over cloud Kerberos trust. Ensure that the machines that you want to enable cloud Kerberos trust have this policy not configured or disabled.
FIX: To fix this issue, we should disable the User’s GPO with ‘User certificate for on-premises authentication’ setting enabled. Once the GPO changes apply to the user/machine, during the next logon, the user should be prompted for the WHfB Cloud Kerberos Trust.
Summary
In this article, we covered how to identify and fix the GPO conflict that causes the status ‘Cloud trust for on premise auth policy is enabled: No’.
I hope you have enjoyed reading this article, and it helps you manage your WHfB Cloud Kerberos trust deployments.
Enjoyed the article? Like and share. 🙂
Note: I do not represent the organization I work for, all the opinions expressed here, are my own. This post is provided AS IS with no warranties or guarantees and confers no rights.
In case you have any suggestions or feedback, please leave a comment.
[ ]’s
Ulysses Neves
