Olliedawg Posted February 24 Posted February 24 We're having issues with SSO for our student users/devices. We are a hybrid setup, devices + users are managed in AD & then synced into Entra. Sophos firewall, Windows 10 22H2 devices using the ESU licence Upon a first login to a machine, SSO does not work 90% of the time. When this behaviour occurs, the user cannot manually sign in to Teams, OneDrive or Edge, they present authentication and/or scripting errors. Logging out and back in again sometimes fixes it. Below is an example of one of the script errors when trying to log in manually to Teams. On a problem machine, I have ran dsregcmd /status. WamDefaultSet : ERROR (0x80070520) AzureAdPrt : NO From what i've read, if the primary refresh token (prt) is not issued during first sign in, SSO will not work. I have tried setting a logon .bat script which runs dsregcmd /refreshprt, this doesn't seem to help at all. I'm thinking about trying to force remove a problem device using dsregcmd /leave , and then dsregcmd /join to force a fresh register in Entra I've checked firewall logs to make sure nothing Microsoft related is being blocked, I've checked HTTPS inspection to make sure we aren't decrypting content to/from Microsoft domains as I've read this can cause issues too. In event viewer, the following error codes are present under AAD: 1104, 1160, 1085, 1081, 1025. Anyone experienced a similar problem?
sraper Posted February 24 Posted February 24 This may help https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start I was sent this yesterday for a similar issue 1
AlphamaleZed Posted February 25 Posted February 25 have you added the policies required? Seems like your missing quite a few. you need the below and trusted urls etc... hide https (Order: 1)hide Generalhide Action Update Properties Hive HKEY_LOCAL_MACHINE Key path SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\autologon.microsoftazuread-sso.com Value name https Value type REG_DWORD Value data 0x1 (1) 1
Olliedawg Posted February 26 Author Posted February 26 23 hours ago, AlphamaleZed said: have you added the policies required? Seems like your missing quite a few. you need the below and trusted urls etc... hide https (Order: 1)hide Generalhide Action Update Properties Hive HKEY_LOCAL_MACHINE Key path SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\autologon.microsoftazuread-sso.com Value name https Value type REG_DWORD Value data 0x1 (1) I definitely have the reg key one you mentioned, I only have 1 of the other group policy options. I'll give them a try.
Olliedawg Posted February 26 Author Posted February 26 Added any I was missing. I've also rolled over our kerberos keys for the AZUREADSSO account, as they hadn't been done for nearly 2 years. Going to do some testing now & fingers crossed! Is it worth setting up a scheduled task on the DC to roll the keys over every 30 days, as microsoft recommends?
Olliedawg Posted February 26 Author Posted February 26 Not sure what else to check now. I've ran through the SSO guides from microsoft, confirmed all required GPO's are in place, confirmed SSO is enabled with the Entra connect tool, rolled over kerberos keys. I ran dsregcmd /status as a test user. Main difference now is that it picks up a PRT first time, but still getting a WAM error WamDefaultSet ERROR 0xd000000d AzureAdPrt YES I asked the guru (chatgpt) and it seems to think that WAM is not present in Windows 10 22H2 Education - I don't believe this is true, surely? We are using the regular Education version, not Education Pro
AlphamaleZed Posted February 26 Posted February 26 4 hours ago, Olliedawg said: I definitely have the reg key one you mentioned, I only have 1 of the other group policy options. I'll give them a try. have you set the DNS entries correct too? that can be found on Domains on o365 Admin centre.
Olliedawg Posted February 26 Author Posted February 26 All lines up ok. I have just completely removed Webview2 from a test machine, reinstalled & now SSO worked on the first login (with no cached profile beforehand..) Going to test that same method on a couple more machines to see if i get the same results.
Olliedawg Posted February 26 Author Posted February 26 45 minutes ago, AlphamaleZed said: have you set the DNS entries correct too? that can be found on Domains on o365 Admin centre. Just to clarify, which DNS entries do you mean? Our tenant?
AlphamaleZed Posted February 26 Posted February 26 24 minutes ago, Olliedawg said: Just to clarify, which DNS entries do you mean? Our tenant? there is some intune ones and other bits too.
Olliedawg Posted February 26 Author Posted February 26 Got that one, I've got all the required external DNS entries too. I've got these steps I'm going to try next... 1. Re register the AAD broker Get-AppxPackage -Name "Microsoft.AAD.BrokerPlugin*" | ForEach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppxManifest.xml"} 2. Completely uninstall Webview2 (user/computer install) & reinstall the computer install 3. dsregcmd /leave, wait a few minutes, dsregcmd /join (or run connect tool to pull devices into Entra)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now