Azure AD Connect Pass-Through Authentication Tips

A few days ago, an updated version of Azure AD Connect was released – 1.1.371.0 (download). This included the public preview of Passthrough Authentication and Seamless Single Sign-on which lets an internal domain connected computer authenticate against an internal domain controller and sign into Office 365 resources. This gives a great cheap option to do this rather than requiring ADFS on premise to do this or just entering user credentials to authenticate against Azure AD; but there are caveats I’ll cover below.

Install Gotcha

After you’ve updated the client (regardless of the authentication type chosen), there’s a quick ‘gotcha’: The Azure AD Connect application shows a different message when you launch it:

“Synchronization has been disabled to allow changes to your current configuration. Azure Active Directory will not receive further updates until reconfiguration is complete.”

 

This is very different from previous versions:

As I was testing passthrough authentication at the time, I misunderstood this message to mean that something was being configured, and I had to wait. What it actually means is that by launching the application, syncs are now paused until you go finish with this program; either by making a configuration change or just exiting.

This also means that if you leave this window open, synchronization will not occur again until it’s closed – even if you have multiple servers set up. If you get an email alert saying synchronisation hasn’t occurred for a while, this is the first thing to is to check that someone didn’t leave the application open.

Azure AD Connect Passthru Auth

I’ve been waiting all year for this option, but there is a lot of misinformation around what it actually can do. After having the privilege of speaking to the Senior Program Manager on SSO and Passthru Auth for Azure AD Connect Ross Adams for two hours (thanks Ross for your invaluable time!) I found out about these key points:

  • Passthrough Authentication right now does not give you a pure automatic authentication experience. It avoids the requirement of having to retype your password, you still need to choose your account
  • Azure AD App Proxy is required for Single Sign-on and Passthrough Authentication, but won’t function for actual application proxying when in this mode. You’ll need a different box running App Proxy if you use it this way.
  • Appending your domain onto supported urls with WHR (Custom login page e.g. https://login.microsoftonline.com/?whr=contoso.com) will reduce the amount of clicks a user needs to get in – generally a single click to pick their account

This doesn’t quite match the experience compared to having ADFS on premise, as I confirmed with friend     Ken Goodwin. This is his explanation of the ADFS experience:

If you just go to office.com to logon, after you type in your email address it’ll redirect you to the adfs server which will automatically log you on (assuming internal). If you pre-specify the domain using https://login.microsoftonline.com/?whr=domin.com, then the logon will be automatic.

This might act differently if you’re able to enable auto-acceleration on your SharePoint sites at least which drops the WHM requirement – as long as you have Azure Active Directory Premium.

Keep in mind, Passthrough Authentication and Single Sign-On are still in public preview so this may change and improve. I’m still having a mixed experience on a few items, so don’t go too crazy with rolling this out to your live setup yet. I expect we’ll see some updates soon, and finish up with a really solid new feature to improve the experience for all.

Update: Another tip – if you disable and re-enable Pass Through Auth then your old Kerberos tickets will be invalid. Wait 10 hours or run the command “Klist purge” on an affected PCs – otherwise you’ll get weird authentication errors when trying to log into a site.

Websites Timing Out – This Page Can’t Be Displayed

timeout

I came across this issue where a particular user was getting lots of timeouts for websites via Internet Explorer. The problem didn’t follow the user to other PCs, and I couldn’t see any firewall issues. The websites were random, but I did notice they were generally slow to load websites.

Another symptom was getting this same error when signing up for things or processing payments – all processes that can take a while to respond. Even loading pictures on emails sometimes timed out this way!

I did find a 3rd party search engine had been added to IE and removed that, but that made no difference.

After a bunch of testing and research being convinced it was a local profile issue, probably around IE timeout settings, I found this article which gave a registry setting around timeouts. I adjusted the value for KeepAliveTimeout in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings but it made no difference.

What I did notice though, was another registry value in the same spot – ReceiveTimeout. This was set to 5000 which would equate to 5 seconds converted from milliseconds, similar to the KeepAliveTimeout setting.

Comparing it to another computer, that registry setting didn’t even exist. I tried upping the value to 60000 for a minute, and after lots more testing, the problem appeared to be fixed! I then deleted the registry key and the problem didn’t reoccur.

My assumption is that the 3rd party search engine (which seemed a bit dodgy) added certain registry settings under the user’s profile for their own purposes, and removing it didn’t clear it up.

Of course, deleting the profile would have had the same result, but then we wouldn’t understand why it broke!

 

 

Changing Many File Permissions Without Inheritance

I ran into a scenario when moving files from an older Windows Server 2003 box to Windows Server 2012, where I couldn’t access folders even as an administrator.

It turned out that not having Users (ServerName\Users) causes problems beyond Windows Server 2003. When moving a mass of files with many folders lacking inheritance, this can be a problem.

After some research and testing, it’s reasonably easy to modify NTFS security permissions to lots of files, while leaving existing settings in tact and not requiring inheritance to apply changes.

Scripting Guy covered it pretty well here, but here’s the condensed version:

First, install File System Security PowerShell Module because it’s easier to do than using native PowerShell Set-ACL commands. This can be installed on a remote box from where the files are, but remote can be slow based on latency and the amount of files you’re dealing with. Read the installation notes on that page so you’re ready to go with the module.

You can test it’s working by running a command like:

get-ntfsaccess -path c:\PutAFilenameHere.Now

You’ll get the permissions of the file back.

To change your permissions on mass, you need to get a listing of the files and pipe that to your modified settings:

dir \\FileServerName\ShareName -recurse | add-ntfsaccess -account “BUILTIN\users” -accessrights read

Note that the -recurse switch gives you all files and subfolders of the share, and although the permission you’re looking at via Windows Explorer will show Users (ServerName\Users), this is actually the BUILTIN\users permission. If you try to use the servername, you’ll get this error:

Add-NTFSAccess : Cannot bind parameter ‘Account’. Cannot convert value “servername\users” to type
“Security2.IdentityReference2”. Error: “Some or all identity references could not be translated.”

That’s it, you can now add, remove or modify permissions all over the place without affecting other existing permissions or affecting the inheritance.

Edit: The actual issue I describe here can also be fixed by changing a few Group Policies too.

AzureAD – Assign Application to User via PowerShell

Scenario:

You’ve created an application in Azure AD, and want to script allocating access to the app rather than using the web interface. App show up at https://myapps.microsoft.com

Azure AD Premium is required for group access which would be ideal, but if you don’t have that you’ll need to add access on a user by user basis.

Answer:

PowerShell of course. First, you’ll need Azure AD for PowerShell (Preview version 2.0.0.17 at time of writing).

The below script which I modified from Philippe’s comment here should cover both internal, cloud and B2B invited users. The original script was using -objectid rather than -searchstring which works better and is more accurate for the internal and cloud accounts, but doesn’t work at all for B2B accounts.

The AppID can be obtained from this command:

Get-AzureADApplication -SearchString “Display Name for App”

Put the corresponding AppID into the below script, and you’re good to go. You’ll get prompted for Azure AD credentials as per usual. You can also get this

This is designed for a single user addition, but you could easily import the email addresses from a CSV file, and do a ‘for each’ on each entry like I did here.

# The UserPrincipalName or ObjectId of the user
$userId = “email@contoso.com”

# The AppId (a.k.a. “client ID”) of the app to assign the user to
$appId = “AppIDGoesHere”

# Connect to Azure AD
Connect-AzureAD -Confirm

# Get the user to be added
$user = Get-AzureADUser -searchstring $userId

# Get the service principal for the app you would like to assign the user to
$servicePrincipal = Get-AzureADServicePrincipal -Filter “appId eq ‘$appId'”

# Create the app role assignment
new-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId $user.ObjectId -ResourceId $servicePrincipal.ObjectId -Id ([Guid]::Empty)

 

Note: If you try this and get the error below, it’s because the app is already assigned.

new-AzureADUserAppRoleAssignment : Error occurred while executing NewUserAppRoleAssignment
StatusCode: BadRequest
ErrorCode: Request_BadRequest
Message: One or more properties are invalid.
At Z:\script.ps1:17 char:1
+ new-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzureADUserAppRoleAssignment], ApiException
+ FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewUser
AppRoleAssignment

Softerra Adaxes – Several Months In

logo-1

Softerra Adaxes is an Active Directory management & automation tool which I’ve grown very fond of.

First I reviewed Softerra Adaxes, then I actually bought Softera Adaxes and even did a brief case study for them. I thought it would now be good to share how far we’ve come through using this tool, and what the experience is like for those considering this option of automation. Here’s my thought process and how I personally approached the rollout, along with my experiences along the way:

Initially to me, the idea of having an ‘Outlook rules’ style approach to building a system that automated user management was enough to me. We’d been creating accounts manually for a long time, and the process was documented but took 20 minutes or so to perform. There was also a lot of room for human error, especially when someone was interrupted while creating an account.

There was of course the ‘selfish’ reason of not wanting to do these user management tasks myself, but it’s hard to pass those tasks off with the inherit risks or lack of knowledge of the tools being used to ease the process. This is what had held me off writing my own giant PowerShell script to automate all the steps.

After mucking around with the Adaxes basics, I started to realise that this software solution seemed to actually deliver on what I was personally looking for – something that wasn’t complex, but also let me define whatever criteria, business rules and caveats to the user creation process that I wanted. On top of that, there was inbuilt webpages where I could deliver these options to other staff requiring no software installs, and the ability to show or lock down whatever I chose, to both control and protect the Active Directory environment.

It did take a few weeks to set up properly, but I wouldn’t have really spent more than an actual day’s worth of work in those few weeks doing it. That was just to create a new user in all the various systems I wanted, with our unique user setting requirements. I wouldn’t say the entire system is so simple and easy to navigate that you can get cracking, but it’s also not complex. Once you find the setting or understand how Adaxes achieves a solution, it’s not difficult to set things up.

The inbuilt functionality of website templates – where you can create multiple sites displaying whichever fields you like to whichever users you like – is a good way to deliver the solution to end users. You can have a page for IT and another page for Finance with completely separate functions to best fit each use case.

For me, it was great that I could create websites with zero programming requirements. It’s all driven by a GUI, and somehow it’s still very flexible in what it can do. It might be frustrating to someone who actually writes code, but that’s not who would normally be using this solution. I really feel it’s aimed at someone like me, the IT Pro/Sys Admin who wants to automate and allow others to use the tools, without needing to code or expect others to run PowerShell commands themselves.

adaxes1Basic site with one option – menu and right side options can even be hidden if required.

Once I’d finished the user creation process and published the method of doing so to a website, I had internal staff muck around with it and use it, purely for new user creations. The feedback I received was immediately positive – that 20 minute or so process had been reduced to a few minutes, and even generated out an email saying the account creation was done. This in itself to me was the tick of a successful project, and I knew I could do a lot more around automation and empowering others to do repeatable tasks.

Some of the problems I hit on the user creation automation were:

  • After upgrading from Lync 2010 to Skype for Business 2015, there were intermittent errors popping up for creating a SfB user. This was a known problem to Softerra, and took several months to resolve with a new version of Adaxes. I did have a workaround luckily, so it only took some rule modifying to work around it until a proper solution was found.
  • ‘User unknown’ – I ran into some problems where I’d create the user or enable them for Exchange, but then the next command wouldn’t find the account. Adaxes was faster than what other systems could replicate changes, so some tactful ‘start-sleep’ PowerShell command steps during the workflows to allow replication to occur before the next step triggered. This does mean that the overall process can take a minute or two, and the person who triggered the user creation has to wait for it to finish.
  • Not all functionality was available that I needed in the GUI. For example, creating a Skype for Business user is easy, but you can’t assign a policy. Instead you need to use PowerShell commands to do what you want. That took a bit longer and needed more testing, but wasn’t much of an issue once I found that out.
  • When a new user was created that already existed (e.g. another John Smith – john.smith) I hadn’t considered that scenario. I asked in the Adaxes forums and was told how to run some pre-checks to make sure the username and phone number were unique and bomb out if they weren’t, rather than half creating an account and having to clean it up afterwards.
  • The upgrade process isn’t painful when a new version of Adaxes comes out (which came out while I was doing the user creation and I wanted to try upgrading early on), but there’s a few more steps than next, next finish. An uninstall is required with backing up a few files, then a fresh install and importing what you backed up. I’m hoping that will be streamlined a bit in the future.

After the user creation process was settled, I started to create more automation tasks. Deprovisioning was an obvious one, and was a lot easier than user creation as well as taking a lot less time to set up. This command would clean up all the bits and pieces from an account, including home drives and Exchange settings (along with moving the mailbox to a different database). This was rolled out relatively quickly.

I should also note, the logging is very helpful. If someone triggers a command from the website, they can see if it was successful or not, or where it failed. It made testing easy to do, but I was also able to read through logs via the GUI on the server to find out more about what failed and why.

adaxes2Updating options on one of the web interfaces – no coding required.

I then decided to wait for common scenarios to come up and build them as needed. We often had ‘returning staff’ which if their Active Directory account still existed, I couldn’t use my user creation method when the account already exists. This took a rethink of how I’d designed my rules so far, and decided to re-do a lot of it in a more modular fashion. Because there’s the ability to copy and paste rules, this was a lot easier than I expected. The end result was that I’d have a list of modules to run against a task – e.,g. a new user would call commands such as ‘enable email’ and ‘enable Skype for Business’ which my new ‘returning staff’ would call ‘re-enable email’ but the same ‘enable Skype for Business’ command as a new user. This now meant I could move a mailbox from one database to another and unhide the user from the Global Address Book when they returned, but because all users have their Skype for Business disabled, that step was the same in either scenario.

Another valuable idea I had was to let users control the membership of Active Directory groups that they were the owner of. After some mucking around, I created a website solely for that purpose. The great part about it was that whomever logged onto the site (with passthrough authentication so no extra typing required) could only see groups they were an owner of, based on the Manager field in Active Directory. This gives anyone in the company who is in control of a group, the ability to add or remove members without any IT assistance required. Perfect for application owners who control who can get to their application or not via a security group.

My next task will be the automation of a user name change. With the updated modular design, I can copy out the steps that I need and modify them to my new requirements; of course finding the hour or two to build and test this is the hardest part. (Note: Between the week of writing this and publishing, I’ve now done it.

I’ll give praise to both the Adaxes forums and their helpdesk support via email- almost always, within 24 hours max (and usually 4-5 hours) I’d get a specific and clear answer on how to do something I couldn’t work out personally, and it was from someone who knew the product rather than a basic 1st level helpdesk type response.

I hope this gives a real impression of my experience and opinion of Softera Adaxes at a high level, after using it for an extended time. There’s no real gaps to the product that I’ve found. and you can pick and choose as to how much customisation you want to do through PowerShell scripting. I’m still happy with the product, and it will continue to evolve with us.

Google Pixel XL Review

Google’s first phone” was released 20th October 2016 (apparently the Nexus series doesn’t count) with overall positive reviews. I happily bought one on release day by walking into a store and buying it – no lineups or fanfare for those picturing an Apple iPhone launch.

img_20161026_093902Pixel XL Box

There’s general reviews all over the place, so I’ll focus more on my opinion of the specs and features. I have the Pixel XL 128GB model, which will be the focus here.

I can’t start a review on this device without talking about the cost, a huge leap in price from the well regarded and mid range Nexus phones. By more than pure coincidence, the Australian pricing for the Google Pixel series is identical to the dollar of the Apple iPhone pricing:

Pixel 32GB – $1079AU
Pixel 128GB – $1229AU
Pixel XL 32GB – $1269AU
Pixel XL 128GB – $1419AU

It’s a hefty ask price wise, and the Australia tax has definitely been put on top when the top model in the US costs $869US – a bit over $1130AU after conversion at the time of writing. The price is by far the biggest drawback, but that doesn’t seem to stop people buying iPhones… so why should Google miss out on all that profit?

20161020_110631-customInside the Google Pixel XL Box

Price aside, the Google Pixel models have a bunch of extras that I hadn’t seen before, coming from a Samsung Galaxy S6 as well as playing with the Oppo R7s.

Let’s go through some of the specs:

Screen – 5.5 inches, QHD AMOLED at 534ppi
Coming from a 5.1″ screen there’s still a noticeable difference in size, and I think the 5.5″ is a better size for a smartphone these days. The quality of the screen was great, I can’t fault it.

20161020_111743-customGoogle Pixel XL Ready To Go

Dimensions – 54.7 x 75.7 x 7.3 ~ 8.5 mm
Nothing amazing here, it’s an average thickness and bezel size for the screen size.

Battery – 3,450 mAh battery, Fast charging: Up to 7 hours of use from only 15 minutes of charging
Fast charge is the norm now on new phones. It’s a great feature, but you do need the right power adapter to make use of it.

20161020_110709-customPower Adapter Specs

Memory – 4 GB LPDDR4 RAM
At the higher end of what you’ll find in a phone now, which should give it a longer life overall.

Storage – 32 or 128GB
Another page out of Apple’s book here. To me, 64GB is the perfect size for a phone as 32GB fills up with apps, high resolution photos and videos. The lack of external SD Card support is disappointing too, which is why I chose the 128GB option.

Processor – Qualcomm® Snapdragon™ 821 2.15Ghz + 1.6Ghz, 64Bit Quad-Core
Another new standard which provides more than enough grunt.

Main camera 12.3 MP and Front camera 8MP
Does anyone choose a phone based on the camera quality? It’s great that this has the best camera in a phone yet quality wise, but as long as it’s good people seem to be happy. Bonus that it’s better than good!

Pixel Imprint – Back-mounted fingerprint sensor for fast unlocking
I’ll talk about this more later, but it works REALLY well.

Ports and slots – USB Type-C™ and 3.5 mm headset jack
One thing Google didn’t copy from Apple was abandoning the 3.5mm headset jack which I think is a good move. Having to have an adapter or special lightning cabled earphones is a bit of a pain, and so is making sure wireless earphones are charged.
The USB Type-C is the way of the future too, so get ready to change over all your cables. Biggest benefit is that just like the lightning cable in iPhones, there’s no upside-down way of trying to put the cable in.

OS – Android 7.1 Nougat
It’s nice to have the latest OS from Google, and with this phone you’ll always get it first. As the specs say – Two years of OS upgrades from launch, Three years of security updates from launch. That’s better than no guarantee, and hopefully they’ll do more than the minimum.

My impressions

Out of the box, the whole ‘migrating from another phone’ implementation was actually pretty good – all the cables required were in the box, it happened quickly and made the new Pixel phone setup a bit easier. It still took me hours to get it the way I wanted, because it doesn’t copy across apps; it just tells your new Pixel what apps you had before and downloads them again, along with syncing contacts and accounts you had saved. Maybe one day we’ll be able to migrate to a new phone and all the settings will be in the cloud?

After the basic setup, Google makes sure you know about it’s voice recognition abilities and recommends you do some training. I declined that as I didn’t want to talk to an inanimate object, but later I did try the weird ‘Lucky Trivia” game show which went on a bit, but was still an amusing novelty.

Setting up the device and navigating around was a bigger change than I expected coming from the Samsung Galaxy S6, and I dare say a Nexus user would have a similar experience. Google have put their own flavour on top of Android – which seems weird when they’re the ones who make Android, but there you go. The home screen is fairly blank when you first start using the phone; swipe left to get a modified Google Search page along with weather, news and calendar updates. Swiping right from the home screen shows an even blanker page for you to fill with your favorite shortcuts. Swiping up however, gives you a single long grid of all your apps that go down a single page with a search option – this seems to make more sense than the pages and pages of apps to swipe through.

I went through the settings and enabled some nifty features like ‘Night Light’ which can tint your screen red and take a lot of the blinding brightness out of the display, something you don’t need when all the lights are out. The best setting I found by far though, was enabling the fingerprint reader to swipe for notifications. Ah yes, the fingerprint reader… it seems weird to place it in the back middle of the phone, but I found that the index finger sits exactly there when holding the phone, and by touch only you can easily find the right spot to unlock the phone with. However, the fingerprint reader can also be used to bring up your notifications with a small swipe. A second small swipe will expand the notifications to an even bigger view. Apart from seeing who’s liked your Instagram photo, you can now respond to SMSes, Skype messages etc right in the context of the notification pane. This seems to be implemented really well and saves you opening a notification to go to the app to respond. Nexus owners already have a fingerprint reader on the back, but don’t and won’t have swipe on it.

Some features such as having a battery % on the top of the screen are really hidden away, requiring a 10 second press on the settings button to unlock several hidden options, including this. I couldn’t work out any way of re-organising the shortcuts in the notification bar (e.g. flashlight, wifi), and the inbuilt widgets I found were feature lacking compared to what my Samsung Galaxy S6 had (one for alarm clock and one for calendar). Also encryption seems to be finally at the hardware level and not optional, hooray for that one! Also with Google’s apparently new security model, expect to see a lot of allow/deny options for every app you run. It’s good to control what app can do what, but I can see people getting annoyed by it.

Here’s a screenshot of how my home screen ended up looking:

screenshot_20161024-172119My Google Pixel XL Home Screen

The camera app also has some cool inbuilt tricks – burst pictures and picks the best one out, automatically makes a collage for you or an animated gif… as well as

burst_cover_collage_20161021065811Burst Collage of my son stealing and eating an apple

img_20161024_161744Keyboard photo

burst_cover_gif_action_20161024201144Animated Gif Test

Conclusion

Is this a must have phone? Not really. Is it worth the price? Not really. But then again, I’d say that about upgrading from an iPhone 6S to a 7. They’re overpriced for what they are in my opinion. It’s still a high quality phone with a lot of cool functions (albeit not waterproof!) and the best way of making sure you’ll get Google’s updates to the Android platform. It also has the Google Assistant which I really can’t be bothered with – yes it works, but I have to verbally give my phone a command. I may as well start wearing a manbun and ride around on a hoverboard.

It’s hard to differentiate the features between Android 7.1 and Google specific – probably by design, to help with the launch. Despite this, it’s a very slick, clean and fast user experience with great battery life (getting close to 2 days for me) and a device that should give you a bit of future protection, due to Google having control over the hardware and software.

The Google Pixel XL is a very good quality phone with good software and good features, but I don’t believe it has anything to make it stand out against the competition. It’s a premium Android at a premium price point. I’m happy that I have it  but I’m unconvinced it’s worth double or triple many of the other Android phones out there.

Google Pixel on the Google Store