The Comms Room

« first day (3748 days earlier) ← previous day next day → last day (1228 days later) »

7:38 PM

Anyone around?

Curious if anyone has any experience around Windows and thinks this belongs on Server Fault over Stack Overflow

Q: gMSA account authentication failure during password rotation

Does anyone else experience outages when gMSA passwords are rotated? When our gMSA accounts are automatically rotated, we see login failures for around 1-10 minutes. This is particularly apparent for gMSA client accounts that connect to MS SQL server, but I think it happens for other gMSA account...

2 hours later…

yagmoth555

9:48 PM

@jcolebrand It could belong, but it seem welcome on SO too, so I'am hesitant to ask for a move

jcolebrand

Oh, no, Makyen has made it clear his disapproval of the question and utter disdain for even trying to get it moved.

He has now got a personal vendetta to prevent it moving. We communally reopened it and he closed it again, even with a chat in the meta TL

I felt the same as you tho. Could go either way. Both are valid sites. Slightly more on topic at Server Fault

yagmoth555

Yeah, especially when you start talking gMSA's account and AD

jcolebrand

right but also could require a code change, idk

we do have a substantial fleet of services but we could change that

We're also looking at how to mass migrate people off TopShelf and Framework 4.8 to something that's dotnet core and maybe 5, maybe just 3.1, but away from TS

So if we did that and changed the way we handle our kerb due to TS or something, that's all groovy. I don't think that TS has any bearing here, but it could since I don't know

Maybe we tell everyone to go drop "windows.system.security.refreshkerb.after(30s)" or something when they refactor off TS?

fwiw they migrated it over

yagmoth555

well, the error itselft could be the replication between domain controller too, as 1-10m, is between the default replication between DC

jcolebrand

10:04 PM

Would that be a timeout that could be changed at the gmsa level or is that domain-wide?

yagmoth555

it's more domain wide, but we will need to figure to which DC the server, where the fail happen, authentificate against, versus where the account got changed.

I seen such error in other way, like an user X that change is password in a complex AD, and it took him like 30m before he can log on in his Exchange OWA, because the Exchange server auth to a remote DC

brb, got to run, diner time

devons

Replication between domain controllers could be an issue, but I'm not seeing any authentication failures on DC's which leads me to believe that it's more related to the token than the password