AADConnect security Advisory

[ModeratelyGruntled]

Hi

 

Had the following email through last night, couldn't see anything else about it on here:

 

Dear Tenant Administrator,

You arecurrently using one of the synchronization tools that Microsoft offers to syncdata from on premises to one of our cloud features, such as Office 365.

 

A security issue has been discovered that potentially exposes your ActiveDirectory environment to a risk of elevated privilege by an unauthorized administrator.

 

You can read more about this issue and which action you must take to protectyour Active Directory environment in this security advisory and in the release notes for the latest release of AADConnect.

Thankyou,

Azure Active Directory Hybrid Team

 

Going to look into actioning today. Does this affect anyone else?

[DJ-1701]

Haven't seen this myself. Which account(s) did it get sent to, the default 365 administrator accounts?

[Boredguy]

I noticed the same message on our 365 Message Centre but slightly confused as the user account it's currently using is just a bog standard domain user without any bells or whistles.

Going to try and read the MS wall of text over a cup of tea

[DJ-1701]

Hmmm... yes... might be the same issue... https://portal.office.com/adminportal/home#/MessageCenter

 

Problem detected: Insufficient restrictions on service account

MC125948

Prevent or Fix Issues

Published On : 12 December 2017

 

Action required by

We’ve detected a problem with Azure AD Connect and previous versions of Sync products due to insufficient restrictions on the service account that these products use when automatically creating the service account during installation.

How does this affect me?

If you don't fix this problem, your Active Directory environment could be compromised by an unauthorized elevation of privilege attack.

What action do I need to take?

To fix this problem you need to restrict the acceess right on the service account to prevent this attack.

 

Click Additional Information to find out more.

 

https://docs.microsoft.com/en-gb/security-updates/securityadvisories/2017/4056318

[3s-gtech]

It's on the dashboard. Just implemented it (I thought why not, our O365 isn't heavily used so downtime isn't critical). Seemed to work nicely.

[ModeratelyGruntled]

Can't get the powershell script to work, doesn't like the credentials. Tried using $credentials ($credentials = Get-Credential):

 

Set-ADSyncRestrictedPermissions : Cannot process argument transformation on parameter 'Credential'. Cannot convert the "mydomain\administrator" value of type "System.String" to type "System.Management.Automation.PSCredential".

 

Probably something daft...

Edited December 13, 2017 by ModeratelyGruntled

[3s-gtech]

It's pretty easy to enact on the object directly if you can. You'll need to use the Advanced button to set the 'Authenticated Users' permissions correctly.

[ModeratelyGruntled]

But powershell > me

 

I've done it now anyway, needed to use the full path to the ObjectDN ie CN=name,DC=domain,DC=local etc

 

Cheers m'dears

[pow]

Done the permissions change to all three of my sites I look after, and reset passwords as a precaution.

[M4tty_j]

What is the command people are using? I can't get mine to work. Must be in Christmas mode already haha

[pow]

I'm going it via AD, much easier.

[ModeratelyGruntled]

https://gallery.technet.microsoft.com/Prepare-Active-Directory-ef20d978

Import-Module .\AdSyncConfig.psm1

Set-ADSyncRestrictedPermissions -ObjectDN <$ObjectDN> -Credential <$Credential>

Edited December 14, 2017 by ModeratelyGruntled

[DJ-1701]

Just to make sure I am dotting i's and crossing t's (and not the other way around ).

It is the account that's listed here that needs to be updated, correct?

 

[ModeratelyGruntled]

Good point - though I read it as referring to the account starting AAD_[iD], with the description Service account for the Synchronization Service with installation identifier [iD] running on computer [server]

[DJ-1701]

Good point - though I read it as referring to the account starting AAD_[iD], with the description Service account for the Synchronization Service with installation identifier [iD] running on computer [server]

 

Ah, for me the account that I refer to has a description of:

Account created by Microsoft Azure Active Directory Connect with installation identifier [iD] running on computer [sERVER] configured to synchronize to tenant [AltMailDomain].onmicrosoft.com. This account must have directory replication permissions in the local Active Directory and write permission on certain attributes to enable Hybrid Deployment.

 

Similar enough as I don't have an AAD_[iD] account, cheers.

Edited December 14, 2017 by DJ-1701

[pow]

The AAD account is the account that runs the sync service, the MSOL one is the one that is vunerable and used to sync the data off to Azure