Often many of us work in an environment that is evolving to the latest OS, but perhaps technology or development of internal applications have held or slowed us from updating these to current standards. We are encouraged to use RSAT tools to manage these hosts and services, but these tools are only backwards compatible by N-1.

This means that with a Windows 10 (current build) laptop, which will use RSAT for 2016, I cannot manage my older Windows 2012 or even 2008r2 hosts. I then have to either use a VM which is running Win7 or 8.1 with RSAT to manage these or access the hosts directly. Making the tool go even backwards compatible N-2 versions would help - after all PowerShell is backwards compatible now.

The moderator from the server forum suggested I post here (please see https://social.technet.microsoft.com/Forums/windowsserver/en-US/a894761b-963e-4e4a-a309-d28999209448/march-2017-security-updates-breaks-ntlm-authentication-of-samba-shares-over-netbios?forum=winserversecurity).

We had a production down weekend after installing Microsoft's security March 2017 rollup. This question is to help us understand what was included in the March rollup that broke production in order that we can properly document the workaround.

Scenario:

1. Windows 2008 R2 domain controllers.


2. March 2017 security rollup applied.


3. SAMBA shares hosted on AIX using NTLM authentication stopped working, giving access denied (client message)
   Error on AIX host is: "FAILED with error NTSTATUSNOLOGONSERVERS"
   Error on AIX host is: "SPNEGO login failed: NTSTATUSIO_TIMEOUT"
   Observed UDP 137 packets sent from AIX to DC, but no response from DC (packets ignored or blocked at DC).


4. Domain controllers previously had installed KB3161949 which broke SAMBA using NETBIOS transport because of a tightened-up security posture due to the KB3161949 hotfix.
   When KB3161949 is installed, there is a HKLM registry setting which will allow NETBIOS (UDP 137) with NTLM authentication outside of the local subnet by setting the AllowNBToInternet DWORD value to 1.


5. After installing March 2017 security rollup the AllowNBToInternet parameter no longer seems to work.

After much effort attempting to back out Microsoft March 2017 security updates on domain controllers (this did not resolve the issue) we solved our problem by making an emergency change to all AIX SAMBA to use Kerberos authentication.

It seems like the March rollup included a critical update to fix a denial of service vector in SMB. I am wondering if the SMB code fork deployed by Microsoft also contained code similar to that included in MS16-077 in a way that prevented the AllowNBToInternet option from working?

And please explain why, even after backing out the March rollup, the functionality of KB3161949 to AllowNBToInternet was no longer operational?

Note background information related to the issues exposed by KB3161949 are here: "https://social.technet.microsoft.com/Forums/windows/en-US/5b32fb1c-bb5d-4be0-8a61-5adcb6ea4eb7/kb3161949-june-2016-update-causes-network-file-shares-to-become-unavailable?forum=w7itpronetworking" and here is a link to the KB: "https://support.microsoft.com/en-us/help/3161949/ms16-077-description-of-the-security-update-for-wpad-june-14,-2016"

In my opinion Microsoft is following a wrong paradigm when it comes to providing server admins with context based background information while working on a server desktop.
It is regarding the use of referrals in the interface to sources on the internet in order to provide the administrator with more information. I know that, when Microsofts recommendation is followed and the core version is chosen, this is no issue at all, but since several server implementations still require the full graphical version (e.g. Exchange Server 2016) and many IT organisations still choose to use RDS for server administration, many admins will still be faced with this phenomenon.

An example: While on the desktop in an interactive session of a Windows Server 2016 machine, I click start -> settings (leftmost part of the startmenu), in the settings window I click “update & security”. Right at the bottom there is a link “Learn more”. Clicking on this link causes Internet Explorer to open in IEESC mode. The page that IE tries to open however needs Java script to be enabled, and without Java script enabled, no content is shown.

And this is my main concern: The Windows interface provides the admin with links that encourage enabling features that undermine security best practices.

What makes it even worse: there is no alternative way to obtain the information via another PC (e.g. from a RD session, copying the link and paste it in the browser of your admin PC), so the admin is forced to configure the server in a manner that conflicts with security best practices (best is to avoid using a browser at all, is my opinion, but apparently that is not Microsofts point of view).

I would like to encourage Microsoft to move to text-only referrals/urls or provide at least a way to copy the link to the clipboard. If that is not feasible somehow, make the web pages behind these links as plain as possible, so there is no need for browser extensions on the server.

Ich habe ein paar Ideen um Windows 10 und Windows 10 Mobil noch besser zu machen.

1. Das größte Problem im Windows 10 und Windows 10 Mobil ist das automatische Update ohne Angabe der Dateigröße und der Zeit für die Installation. Update von Build oder App-Update legt Rechner für Stunden lahm!




2. Windows 10 Mobil hängt sich auf und das Smartphone sollte zurückgesetzt werden. Alle Daten auf dem Smartphone sind weg, sowas geht nicht in der Arbeitswelt.




3. Die Sicherheit ist bei Firmen sehr wichtig, darum muss klar sein wo die Daten liegen und teilweise kommt eine Cloudlösung nicht in Frage, weil die Daten nichts auf einem fremden System zu suchen haben. Man kann durch einen Hackerangriff oder Mitarbeiterzugriff alle Daten zentral finden, was unerwünscht ist! Auch die Datenleitungen werden massiv benutzt da die Daten immer von der Cloud abgefragt werden müßen!

4. Was unterscheidet der Microsoft Mobil von Apple, Samsung usw. Da muss schon eine tolle App daher, der Dock-PC ist hier schon ein gute Idee, aber wieso nur mit Office-Produkte usw...

Für diese Punkte usw. hätte ich ein paar Ideen für Microsoft :-)

Mit freundlichen Grüßen

Cross-posted from Technet forums:

I think we've identified a bug in Server 2016. Long story short:
1. Open lusrmgr.msc
2. Set an active users' properties to require password change at next logon
3. Reboot (or just logout, haven't tried that)
4. Press Ctrl+Alt+Del to logon, enter user's current password
5. Press Cancel when informed you need to change your password
6. Press Ctrl+Alt+Del again, enter user's current password, proceed 7. with password change (notice username is blank at this point)
8. Password gets changed but you are returned to the change password screen with no way to go back or proceed
9. Forced reboot appears to be the only way out but you can logon normally after this

We discovered this when running through the sysprep process and had bypassed the standard OOBE set password screen. Windows Server still wants the password set at first logon so we end up setting the password in the standard password change method instead of via OOBE. I realized this wasn't just a problem with our OOBE process though because just checking the box in user properties will make it happen. Tested this on the built-in Administrator account and a standard account I created after the fact.

Obviously most people won't hit the cancel button here, but we did it just playing around and discovered this.

I have a conceptual idea of how to secure all the communication, files, and computing resources without the regards where the resources are located. Basically, this would allow to control access to any file on the accessible network or a cloud using the infrastructure/code idea that I have in mind.

I had several conversation with the business owners about the security of the data (files and etc) when it comes to employees parting with the companies or trying to sabotage the resources. Business owners need total control of the data and preclude those leaving the company to copy the data and carry the data to outside of the company. My solution addresses this. Expending this idea, it is possible to preclude many insider threats form happening by tightly controlling what resources or data items area accessed.

If interested, get in touch with me. (however, I do not thing this will get anywhere - I do not think this is being read by humans)

Aleksey Kramer, Ph.D.