2022 年 5 月 微软改变了客户端证书映射到 AD 帐户的方式，导致 802.1X EAP-TLS 计算机帐户身份验证停止工作。以下是具有详细背景信息的附加资源在 Schannel<=>Kerbers S4U2 上自我认证
对此可用的解决方案是：
- 使用创建强映射替代安全身份映射
- 使用新的证书扩展szOID_NTDS_CA_SECURITY_EXT
- 通过以下方式暂时禁用 Schannel<=>Kerberos S4u2Self证书映射方法注册表项和设置标志 0x4 用于 SAN 证书映射
如果 NPS 服务器和客户端计算机帐户位于同一个域中，那么这一切都可以正常工作。 然而，在我们的场景中，NPS 服务器位于林的根域中，而客户端计算机帐户位于子域中。 这会导致所有子域中的计算机帐户身份验证失败，原因代码为 16，并在 NPS 服务器上记录事件 4625 和 6273。
根域（如 NPS 服务器）中的计算机帐户可以成功进行身份验证
问题似乎出在 Schannel 和 Kerberos 身份验证之间：
- 设置证书映射方法将所有子域控制器和 NPS 服务器上的密钥设置为 0x1F 使身份验证工作（不幸的是，这只是临时解决方案）
- 使用创建强映射替代安全身份映射无效；DC 上未记录任何事件；NPS 服务器上的错误没有变化；没有明显差异
- 使用新的证书扩展szOID_NTDS_CA_SECURITY_EXT没有效果；身份验证仍然失败
RADIUS 服务器上记录的错误是：
事件 4625
An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: <NPS SERVER>$
Account Domain: <NPS SERVER DOMAIN>
Logon ID: 0x3E7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Process Information:
Caller Process ID: 0x278
Caller Process Name: C:\Windows\System32\lsass.exe
Network Information:
Workstation Name: <NPS SERVER>
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Schannel
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
事件 6273
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID: <CLIENT DOMAIN>\<COMPUTER ACCOUNT>$
Account Name: host/<client DNS>
Account Domain: <CLIENT DOMAIN>
Fully Qualified Account Name: <CLIENT DOMAIN>\<COMPUTER ACCOUNT>$
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
Called Station Identifier: 6E-22-32-2F-19-CF:<SSID>
Calling Station Identifier: 84-38-38-86-82-C2
NAS:
NAS IPv4 Address: <ap ip>
NAS IPv6 Address: -
NAS Identifier: 6e22322f09cf
NAS Port-Type: Wireless - IEEE 802.11
NAS Port: 1
RADIUS Client:
Client Friendly Name: <ap name>
Client IP Address: <ap ip>
Authentication Details:
Connection Request Policy Name: Secure Wireless Connections
Network Policy Name: Secure Wireless Connections
Authentication Provider: Windows
Authentication Server: <DOMAIN CONTROLLER FQDN>
Authentication Type: EAP
EAP Type: Microsoft: Smart Card or other certificate
Account Session Identifier: 43323444383435463834444530463634
Logging Results: Accounting information was written to the SQL data store.
Reason Code: 16
Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.
看起来 NPS 服务器不知为何无法获取子域的 Kerberos 票证；但我也不确定。
总结一下：身份验证有效，除非客户端是与 NPS 服务器（或同级域）位于同一林的双向受信任子域。
还尝试过：
- 将 NPS 服务器添加到子域中的“RAS 和 IAS 服务器”组
我们缺少哪些配置选项？
答案1
有同样情况：
事实证明，需要让 NPS 服务器按照以下步骤执行 TSL 1.2：
https://warlord0blog.wordpress.com/2017/02/09/tls-and-nps/ https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-for-microsoft-eap-implementation-that-enables-the-use-of-tls-october-14-2014-d9ba4b83-b4e9-2c01-83a7-e42706e671af
否则，安装了 2022 年 12 月更新的 Win 11 22H2 客户端将无法连接