{"id":2965,"date":"2024-03-05T14:54:51","date_gmt":"2024-03-05T13:54:51","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=2965"},"modified":"2024-03-08T15:00:53","modified_gmt":"2024-03-08T14:00:53","slug":"entra-private-access-windows-hello-for-business-kerberos-trust-network-drive-fails-for-10-min","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=2965","title":{"rendered":"Entra Private Access &#038; Windows Hello for Business Kerberos Trust &#8211; Network Drive Fails for 10 min. after restart and user login"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If you are using Entra Private Access (or other SSE solutions) &#8211; together with Windows Hello for Business Kerberos Trust, you might experience that access to network drives fails for 10 mins. after restart and user login. Error &#8220;The system cannot contact a domain controller to service the authentication request&#8221;. After 10 min, it works !<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Root Cause<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Client is trying to connect to closest DC for Kerberos ticket but fails as Entra Private Access (EPA) is still not connected or DC is not reachable at that moment. Once this request fails, it does not try to connect again for next 10 minutes as this is the default value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During the default 10 min, EPA is connected and Private DNS resolution is working. However, client is still holding that negative cache entry and thinks that the DC locate process is not working. Once the time is reached, client can query DC for ticket and the connection is successful.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">End-user experience<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Below are 2 examples of end-user messages. As you can see, they will increase the helpdesk calls so my focus has been to find the best solution. Please see Workaround Method #1 below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"522\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4-1024x522.png\" alt=\"\" class=\"wp-image-2993\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4-1024x522.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4-300x153.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4-768x392.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4-1536x783.png 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-4.png 1663w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"491\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-3-1024x491.png\" alt=\"\" class=\"wp-image-2985\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-3-1024x491.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-3-300x144.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-3-768x369.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-3.png 1415w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Workaround Method #1 (best end-user experience)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As part of my testing, I have found that setting the parameter <strong>FarKDCTimeout<\/strong> to <strong>0 (disabled)<\/strong>, gives the best end-user experience.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-server\/windows-security\/kerberos-protocol-registry-kdc-configuration-keys\">read about the settings here<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>Entry: FarKdcTimeout\n\nType: REG_DWORD\n\nDefault value: 10 (minutes)\n\nIt's the time-out value that's used to invalidate a domain controller from a different site in the domain controller cache.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Recommended setting<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"257\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-2-1024x257.png\" alt=\"\" class=\"wp-image-2984\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-2-1024x257.png 1024w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-2-300x75.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-2-768x193.png 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/03\/image-2.png 1415w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>New-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters\" -Name FarKdcTimeout -PropertyType DWORD -Value \"0\" -Force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Consequences (please evaluate according to your environment)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Setting the FarKdcTimeout registry value to 0 means that the system will not wait before trying to connect to a domain controller (DC) again after a failed attempt. This means that the client will immediately try to connect to the DC again if the first attempt fails, instead of waiting for the time specified in the FarKdcTimeout value. \n\nThis can help reduce the time it takes for the client to obtain a Kerberos ticket from the DC, but it may also increase the load on the DC if there are many clients repeatedly trying to connect.\n\nThe extra load will only happen until the EPA client is running and then the connections to DCs are available and KDC will be happy.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Workaround Method #2 (not the best !)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can also lower the KDC negative caching to e.g. 1 min, but in my experience end-users see will start to see errors during that 1 min, when they try to access e.g. network drives &#8211; and especially the popup &#8220;Windows needs your current credentials&#8221; causes calls to helpdesk.<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>New-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters\" -Name FarKdcTimeout -PropertyType DWORD -Value \"1\" -Force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Workaround Method #3<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can also resolve the issue with an scheduled task using script below which executes the command KLIST PURGE_BIND to run after user logon &#8211; after waiting initially 10 sec. This command will delete the negative cache entry.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Windows\\System32&gt;klist purge_bind\n\nCurrent LogonId is 0:0xxxxx\nThe kerberos KDC binding cache has been purged successfully.<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe -Command \"Start-Sleep -Seconds 10; KLIST PURGE_BIND\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">More info<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Issue has been reported to Entra Private Access product team to se if they can fix this as part of EPA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Script for Intune (Workaround #3)<\/h2>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>$Action = New-ScheduledTaskAction -Execute 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ' -Argument '-Command \"Start-Sleep -Seconds 10; KLIST PURGE_BIND\"'\n\n$trigger =  New-ScheduledTaskTrigger -AtLogOn\n\n$STPrin = New-ScheduledTaskPrincipal -UserId \"SYSTEM\" -LogonType ServiceAccount -RunLevel Highest\n\nRegister-ScheduledTask -Action $action `\n                       -Trigger $trigger `\n                       -TaskName \"Intune_Kerberos_Negative_Cache_Reset\" `\n                       -Description \"Intune_Kerberos_Negative_Cache_Reset\" `\n                       -Principal $STPrin\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>If you are using Entra Private Access (or other SSE solutions) &#8211; together with Windows Hello for Business Kerberos Trust, &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Entra Private Access &#038; Windows Hello for Business Kerberos Trust &#8211; Network Drive Fails for 10 min. after restart and user login\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=2965#more-2965\" aria-label=\"Read more about Entra Private Access &#038; Windows Hello for Business Kerberos Trust &#8211; Network Drive Fails for 10 min. after restart and user login\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[158,160,159],"tags":[],"class_list":["post-2965","post","type-post","status-publish","format-standard","hentry","category-entra-private-access","category-intune","category-windows-hello-for-business","infinite-scroll-item"],"featured_image_src":null,"author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2965"}],"version-history":[{"count":24,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2965\/revisions"}],"predecessor-version":[{"id":3001,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/2965\/revisions\/3001"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}