Windows Hello For Business

[colly72]

I'm having problems setting up WIndows Hello for Business.  I'm using Cloud Kerberos Trust authentication in a hybrid local AD/Entra environment but when I try and create the Kerberos Server Object (as per https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#install-the-azureadhybridauthenticationmanagement-module) I get the following error:

 

Set-AzureADKerberosServer: failed to create MIcrosoft Entra ID Kerberos Server: Error sending directory request: The user has insufficient access rights

 

The account I'm using has domain admin rights and is not a protected user, so I'm at a loss as to what the issue is.

 

Any suggestions gratefully received!

[psydii]

Could it be the Entra side of things? What roles does the account have for Entra?  Which version of the script are you using to do this? I'd have thought this one (example 4) would offer the best chance of success in a reasonably configured 365 environment: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#example-4-prompt-for-cloud-credentials-using-modern-authentication

[colly72]

Example 4 (modern authentication) is the version I'm trying.  The Entra account has the Hybrid Identity Administrator and Global Administrator roles too

[psydii]

(I'm just reading that page too, so you're probably ahead of anything I have to say) The only other thing that jumps out at me (assuming you are *sure* you're running the command as domain admin, and you have completed the modern authentication process, is the recommendation to run the command from the server with Entra Connect installed so that the powershell command has access to the necessary dlls. But I'd expect a more dll focused error if that were the problem.

[colly72]

In the end, I got round this by using the built-in AD administrator account  (we normally have this disabled).  I'm not sure why another AD account with domain admin and enterprise admin permissions wouldn't work (there must be some specific ACL/deny permissions in AD somewhere).

[ITGuyNW]

Quick question on Kerberos cloud trust as I'm getting confused...

 

We are on-prem AD, synced to Entra AD so hybrid

 

If I enable Windows Hello in GPO, users can then set their hello credentials and it all works, whether they're on domain or off. As these credentials are kept on the machine, I assume this never expires?

 

Where does kerberos come in? Is this for those who authenticate with Entra AD instead of on prem? 

[colly72]

If you're talking about a PIN, this might help you out:

 

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/policy-settings?tabs=pin

 

For a deep dive on Kerberos, together with SSPR and WHfB this might help:

 

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/how-it-works-authentication#microsoft-entra-hybrid-join-authentication-using-cloud-kerberos-trust