AuthLite 2-Factor for Windows Administration J. Greg Mackinnon Windows Technical Lead | Cloud Engineering Yale University | Information Technology Services

What it is: Software that installs on your domain controllers Creates a DS partition: Holds MFA device seeds and user associations Holds AD group transformation rules Intercepts authentication attempts: Does the username match an enrolled user? If so, transform 1FA groups to 2FA groups

How to implement: When authenticating with 1-factor, standard group memberships apply. All 1F logons are added to the global “1FactorTag” group. This group can be added to “Deny” ACLs or “Deny logon to Remote Desktop Services” local security policy. Two factor logons get transformed according to a table stored in AD. Grant access to the “two-factor” groups, not the one factor groups. This allows easy implementation of “Authentication Method Assurance”.

Sign-In Experience: No Client (Yubikey): Username: [DOMAIN]\[OTP] Password: [1F Password] No Client (OATH): Username: [DOMAIN]\[NetID]-[OTP] With Client: Username: [DOMAIN]\[NetID] Password: [1F Password]-[OTP]

Advantages: Multi-protocol protection: Low Cost: “Windows Auth”: NTLM/Kerberos on RDP, WinRM, SMB, RPC, others. Support for RADIUS and LDAP Low Cost: Perpetual licenses, upgrades included Inexpensive / free tokens: Yubikey Google Authenticator (soft token) Any other OATH / tOTP token Simple “Authentication Method Assurance”, for Kerberos and NTLM Clientless architecture (Works with Mac/Linux!): Does not require Windows 10 (Unlike “Windows Hello”) No client-side drivers, crypto providers, or other software required (Unlike “Smart Card”) Resides in the Domain Controller: No internet access or proxy required (unlike Duo) No additional servers required (unlike RSA) No need to provision accounts in an external provider (unlike RSA or Duo) Easy provisioning. LDAP integration can be used to secure high-value targets such as VMware vCenter.

Disadvantages OMG! Third party software on the domain controllers! OMG! Tiny vendor, no “magic quadrant”. Still does not protect you from Pass-the-ticket! Not a great fit for broad-access applications Retraining required for logon process Not as intuitive as other solutions such as Duo Might be impossible to use with SAML Probably not useful for many Cloud solutions Our intention is to use AuthLite to secure Windows Admin credentials, not to be used as a general purpose MFA solution.

References Smart Card and NTLM hashes: http://www.infosecisland.com/blogview/23657-Smart-Card-Logon- The-Good-the-Bad-and-the-Ugly.html AuthLite and Pass-the-Hash: http://www.collectivesoftware.com/blog/blog-articles/exploring- pass-the-hash-authentication-authorization-and-security-groups/ Win High-Ed Discussion on AuthLite: https://mailman.stanford.edu/mailman/private/windows-hied/2015- November/019376.html