Skip to content

Commit 6eb6359

Browse files
v-tappelgatev-tappelgate
authored
Merge pull request #10279 from v-tappelgate/AB#8046-Confidential-attributes-on-WS2025-dc
AB#8046: Confidential attributes on WServer 2025 DC
2 parents 0c0d96d + edf1860 commit 6eb6359

File tree

3 files changed

+361
-0
lines changed

3 files changed

+361
-0
lines changed

‎support/windows-client/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1341,6 +1341,8 @@ items:
13411341
items:
13421342
- name: Enable diagnostic logging for the Windows Security app
13431343
href: ./windows-security/how-to-enable-diagnostic-logging-for-windows-security-center.md
1344+
- name: Operations on confidential attributes produce unexpected results when using Windows Server 2025 DCs
1345+
href: ../windows-server/windows-security/confidential-attributes-unexpected-behavior-using-windows-server-2025-dc.md?context=/troubleshoot/windows-client/context/context
13441346
- name: Zero Trust DNS
13451347
items:
13461348
- name: 'Troubleshooting Guidance: Zero Trust DNS'

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3112,6 +3112,8 @@ items:
31123112
href: ./windows-security/mark-attribute-as-confidential.md
31133113
- name: Maximum number of access control entries
31143114
href: ./windows-security/error-add-user-to-security-permissions.md
3115+
- name: Operations on confidential attributes produce unexpected results when using Windows Server 2025 DCs
3116+
href: ./windows-security/confidential-attributes-unexpected-behavior-using-windows-server-2025-dc.md
31153117
- name: Security auditing settings aren't applied when you deploy domain-based policy
31163118
href: ./windows-security/security-auditing-settings-not-applied-when-deploy-domain-based-policy.md
31173119
- name: SeImpersonatePrivilege and SeCreateGlobalPrivilege

‎support/windows-server/windows-security/confidential-attributes-unexpected-behavior-using-windows-server-2025-dc.md‎

Lines changed: 357 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,357 @@
1+
---
2+
title: Operations on Confidential Attributes Produce Unexpected Results When Using Windows Server 2025 DCs
3+
description: Discusses new requirements for using LDAP clients to access confidential attributes while connected to Windows Server 2025-based domain controllers (DCs).
4+
ms.date: 12/05/2025
5+
manager: dcscontentpm
6+
audience: ITPro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, herbertm, v-appelgatet
9+
ms.custom:
10+
- sap:windows security technologies\ad object permissions, access control, delegation, adminsdholder and auditing
11+
- pcy:WinComm Directory Services
12+
appliesto:
13+
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a>
14+
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Supported versions of Windows Client</a>
15+
---
16+
# Unexpected results for operations on confidential attributes on Windows Server 2025 DCs
17+
18+
This article discusses new requirements for using LDAP clients to access confidential attributes while they're connected to Windows Server 2025-based domain controllers (DCs).
19+
20+
## Symptoms
21+
22+
When you search for or edit Active Directory Domain Services (AD DS) objects, you notice the following behavior:
23+
24+
- When you run a Lightweight Directory Access Protocol (LDAP) search request against a Windows Server 2025-based DC, the resulting attribute list doesn't include confidential attributes. However, if you run the same LDAP query against a DC that runs on Windows Server 2022 or earlier, you obtain a full attribute list in the response.
25+
26+
- When you run an LDAP update request that adds or modifies confidential attribute values against a Windows Server 2025-based DC, the update request fails and returns an `INSUFF_ACCESS_RIGHTS` error message. If you run the same LDAP update request against a DC that runs on Windows Server 2022 or earlier, the update request succeeds.
27+
28+
### Example 1: Search results omit confidential attributes
29+
30+
In this example, you run an [Ldifde](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)) query try to read the legacy Local Administrator Password Solution (LAPS) password attribute. The query resembles the following example:
31+
32+
```console
33+
ldifde /s DC25 /d "CN=test-comp01,OU=New-Computers,DC=contoso,DC=com" /f test-comp01.txt /l ms-Mcs-AdmPwd,cn
34+
```
35+
36+
The client connects and exports a list of the object's attributes, and generates output that resembles the following example (as expected).
37+
38+
```output
39+
Connecting to "dc25"
40+
Logging in as current user using SSPI
41+
Exporting directory to file test-comp01.txt
42+
Searching for entries...
43+
Writing out entries.
44+
1 entries exported
45+
```
46+
47+
> [!NOTE]
48+
> This example text is created by using an LDAP client on Windows 11, 23H2, or an earlier version of Windows.
49+
50+
However, when you review the exported list, you find the "cn" attribute but not the "ms-Mcs-AdmPwd" attribute.
51+
52+
When you target the query to a DC that runs an earlier version of Windows, the resulting exported list includes both "cn" and "ms-Mcs-AdmPwd."
53+
54+
The following table summarizes the behavior across different client and server versions.
55+
56+
| Client | Target DC | Returned attributes |
57+
| --- | --- | --- |
58+
| Windows 11, version 24H2 | Windows Server 2025 | "cn"<br />"ms-Mcs-AdmPwd" |
59+
| Windows Server 2025 (member server) | Windows Server 2025 | "cn"<br />"ms-Mcs-AdmPwd" |
60+
| Windows versions earlier than Windows 11, version 24H2 | Windows Server 2025 | "cn" |
61+
| Non-Windows operating system (for example, a UNIX-based client) | Windows Server 2025 | "cn" |
62+
| Windows versions earlier than Windows 11, version 24H2 | Windows Server 2022 or an earlier version | "cn"<br />"ms-Mcs-AdmPwd" |
63+
| Non-Windows operating system (for example, a UNIX-based client) | Windows Server 2022 or an earlier version | "cn"<br />"ms-Mcs-AdmPwd" |
64+
65+
### Example 2: Operations on confidential attributes fail
66+
67+
In this example, you create an LDIFDE file (named Update.txt) that modifies the value of a confidential attribute. For convenience, this example refers to the same legacy LAPS password as the previous example. (Note: We don't recommend this type of change in practice). The file text resembles the following example:
68+
69+
```console
70+
dn: CN=test-comp01,OU=New-Computers,DC=contoso,DC=com
71+
changetype: modify
72+
replace: ms-Mcs-AdmPwd
73+
ms-Mcs-AdmPwd: <PasswordText>
74+
-
75+
```
76+
77+
To import the file, open a Windows Command Prompt window, and then run the following command:
78+
79+
```console
80+
ldifde /s dc25 -i /f .\update.txt
81+
```
82+
83+
The resulting output resembles the following example:
84+
85+
```output
86+
Connecting to "dc25"
87+
Logging in as current user using SSPI
88+
Importing directory from file ".\update.txt"
89+
Loading entries.
90+
Add error on entry starting on line 1: Insufficient Rights
91+
The server side error is: 0x2098 Insufficient access rights to perform the operation.
92+
The extended server error is:
93+
00002098: SecErr: DSID-03151656, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
94+
```
95+
96+
When you use a similar approach to try to create an object and set a value for a confidential attribute on that object, the resulting output resembles the following example:
97+
98+
```output
99+
Add error on entry starting on line 1: Insufficient Rights
100+
The server side error is: 0x2098 Insufficient access rights to perform the operation.
101+
The extended server error is:
102+
00002098: SecErr: DSID-03153BAC, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
103+
```
104+
105+
Similarly to the previous query example, the operations succeed or fail depending on the client and server versions. The following table summarizes these interactions.
106+
107+
| Client | Target DC | Operation result |
108+
| --- | --- | --- |
109+
| Windows 11, version 24H2 | Windows Server 2025 | Success |
110+
| Windows Server 2025 (member server) | Windows Server 2025 | Success |
111+
| Windows version earlier than Windows 11, version 24H2 | Windows Server 2025 | INSUFF_ACCESS_RIGHTS |
112+
| Non-Windows operating system (for example, a UNIX-based client) | Windows Server 2025 | INSUFF_ACCESS_RIGHTS |
113+
| Windows version earlier than Windows 11, version 24H2 | Windows Server 2022 or an earlier version | Success |
114+
| Non-Windows operating system (for example, a UNIX-based client) | Windows Server 2022 or an earlier version | Success |
115+
116+
## Cause
117+
118+
Because of new functionality in Windows Server 2025 DCs, your administrative client must establish an encrypted connection to AD DS in order to search, read, add, or modify confidential object attributes. [What's new in Windows Server 2025](/windows-server/get-started/whats-new-windows-server-2025#active-directory-domain-services) describes the new functionality:
119+
120+
- **Improved security for confidential attributes**: DCs and AD LDS instances allow LDAP only to add, search, and modify operations that involve confidential attributes when the connection is encrypted.
121+
122+
This behavior doesn't affect LDAP clients that run on Windows Server 2025-based member servers or Windows 11, version 24H2-based computers. On these operating system versions, LDAP clients use encrypted sessions by default.
123+
124+
## Workaround
125+
126+
To work around this issue, use one of the following methods:
127+
128+
- Configure your LDAP client to use the [**LDAP_OPT_ENCRYPT**](/previous-versions/windows/desktop/ldap/session-options) session option (or update to a client that supports this option). If you're using ldifde on Windows, use the `/h` switch (for example, run `ldifde /h /s dc25 -i /f .\update.txt`).
129+
130+
- Use Windows Server 2025 or Windows 11 24H2, or a newer version, as an LDAP client. By default, these operating systems encrypt LDAP sessions. For more information about this feature, see [What's new in Windows Server 2025](/windows-server/get-started/whats-new-windows-server-2025#active-directory-domain-services).
131+
132+
- If you can't use either of the previous methods, you can temporarily disable the encrypted session requirements. For more information, see [How dsHeuristics affects the encrypted session requirements and related events](#how-dsheuristics-affects-the-encrypted-session-requirements-and-related-events) in this article.
133+
134+
> [!IMPORTANT]
135+
> This method isn't secure. Use it only as a temporary step.
136+
137+
## More information
138+
139+
Several new Directory Service events document this behavior. The following table summarizes these events.
140+
141+
| Event ID | Action that a client attempted during an unencrypted session | User error (returned to the client) |
142+
| --- | --- | --- |
143+
| 3079 | Search for one or more confidential attributes. | None |
144+
| 3080 | Set a value for a confidential attribute of an existing object. | `INSUFF_ACCESS_RIGHTS` |
145+
| 3081 | Add an object that has values for confidential attributes. | `INSUFF_ACCESS_RIGHTS` |
146+
147+
### Details of Event ID 3079
148+
149+
```output
150+
Log Name: Directory Service
151+
Source: Microsoft-Windows-ActiveDirectory_DomainService
152+
Event ID: 3079
153+
Task Category: Security
154+
Level: Warning
155+
Keywords: Classic
156+
User: contoso\admin
157+
Computer: dc25.contoso.com
158+
Description:
159+
The directory blocked access to one or more confidential attributes on one or more LDAP search requests because one or more clients were using an unencrypted LDAP connection.
160+
```
161+
162+
### Details of Event ID 3080
163+
164+
```output
165+
Log Name: Directory Service
166+
Source: Microsoft-Windows-ActiveDirectory_DomainService
167+
Event ID: 3080
168+
Task Category: Security
169+
Level: Warning
170+
User: contoso\admin
171+
Computer: dc25.contoso.com
172+
Description:
173+
The directory blocked one or more LDAP modify requests including changes to one or more confidential attributes because one or more clients were using an unencrypted LDAP connection.
174+
```
175+
176+
### Details of Event ID 3081
177+
178+
```output
179+
Log Name: Directory Service
180+
Source: Microsoft-Windows-ActiveDirectory_DomainService
181+
Event ID: 3081
182+
Task Category: Security
183+
Level: Warning
184+
User: contoso\admin
185+
Computer: dc25.contoso.com
186+
Description:
187+
The directory blocked one or more LDAP add requests including changes to one or more confidential attributes because one or more clients were using an unencrypted LDAP connection.
188+
```
189+
190+
### How dsHeuristics affects the encrypted session requirements and related events
191+
192+
It's possible (for example, in testing scenarios) to use the `dsHeuristics` attribute to modify the requirements for encrypted sessions. For example, if you configure `dsHeuristics` to disable the encrypted session requirement for searching confidential attributes, searches that use nonencrypted sessions successfully return both nonconfidential and confidential results. Event ID 3079 doesn't appear in the event log.
193+
194+
The `dsHeuristics` value is a string in which individual characters or sets of characters reflect parameter values. The 31st character represents the value of `DisableConfidentialAttributeEncryptionRequirements`. This value ranges from **0** (all the encrypted session requirements are enforced) to **7** (all the encrypted session requirements are disabled). For example, **0000000001000000000200000000037** is a `dsHeuristics` value that disables all the encrypted session requirements. `DisableConfidentialAttributeEncryptionRequirements` is a three-bit value. The following table describes how the values correlate to the encrypted session requirements.
195+
196+
| Affected requirement | Bit | Not set (default) | Set (integer value) |
197+
| --- | --- | --- | --- |
198+
| Encrypted session required to search confidential attribute values | 0 | **0** (enforced) | **1** (disabled) |
199+
| Encrypted session required to modify existing confidential attribute values | 1 | **0** (enforced) | **2** (disabled) |
200+
| Encrypted session required to add an object that has confidential attribute values | 2 | **0** (enforced) | **4** (disabled) |
201+
202+
For more information about `dsHeuristics`, see [6.1.1.2.4.1.2 dSHeuristics](/openspecs/windows_protocols/ms-adts/e5899be4-862e-496f-9a38-33950617d2c5).
203+
204+
When AD DS starts, it checks `dsHeuristics`. If any of the encrypted session requirements are disabled, it logs the appropriate events to document that fact. The following table lists these events, the corresponding disabled requirements, and the events that the `dsHeuristics` setting suppresses.
205+
206+
| Event ID | Effects of the corresponding `dsHeuristic` setting | Suppressed Event ID |
207+
| --- | --- | --- |
208+
| 3076 | Encrypted sessions aren't required for searches of confidential attributes | 3079 |
209+
| 3077 | Encrypted sessions aren't required to modify existing confidential attributes | 3080 |
210+
| 3078 | Encrypted sessions aren't required to add objects that have confidential attributes | 3081 |
211+
212+
#### Details for Event ID 3076
213+
214+
```output
215+
Log Name: Directory Service
216+
Source: Microsoft-Windows-ActiveDirectory_DomainService
217+
Event ID: 3076
218+
Task Category: Security
219+
Level: Warning
220+
Keywords: Classic
221+
User: contoso\admin
222+
Computer: dc25.contoso.com
223+
Description:
224+
The directory has been configured to return confidential attributes for LDAP search requests on unencrypted LDAP connections. No events will be logged and no requests will be blocked.
225+
226+
This setting is not secure and should only be used as a temporary step.
227+
```
228+
229+
#### Details of Event ID 3077
230+
231+
```output
232+
Log Name: Directory Service
233+
Source: Microsoft-Windows-ActiveDirectory_DomainService
234+
Event ID: 3077
235+
Task Category: Security
236+
Level: Warning
237+
Keywords: Classic
238+
User: contoso\admin
239+
Computer: dc25.contoso.com
240+
Description:
241+
The directory has been configured to allow modifying confidential attributes on unencrypted LDAP connections. No events will be logged and no requests will be blocked.
242+
243+
This setting is not secure and should only be used as a temporary step.
244+
```
245+
246+
#### Details of Event ID 3078
247+
248+
```output
249+
Log Name: Directory Service
250+
Source: Microsoft-Windows-ActiveDirectory_DomainService
251+
Event ID: 3078
252+
Task Category: Security
253+
Level: Warning
254+
Keywords: Classic
255+
User: contoso\admin
256+
Computer: dc25.contoso.com
257+
Description:
258+
The directory has been configured to allow adding new objects with confidential attributes on unencrypted LDAP connections. No events will be logged and no requests will be blocked.
259+
260+
This setting is not secure and should only be used as a temporary step.
261+
```
262+
263+
### Deeper investigation
264+
265+
[!INCLUDE [Registry important alert](../../../includes/registry-important-alert.md)]
266+
267+
For queries, if you want to verify that clients are using unencrypted sessions, you can correlate Event ID 3079 with field engineering Event ID 1644. To turn on verbose logging and maximize the event information that the queries generate, run the following commands at a Windows command prompt:
268+
269+
```console
270+
reg add "hklm\system\currentcontrolset\services\ntds\parameters" /v "Expensive Search Results Threshold" /t reg_dword /d 00000001 /f
271+
```
272+
273+
```console
274+
reg add "hklm\system\currentcontrolset\services\ntds\parameters" /v "Inefficient Search Results Threshold" /t reg_dword /d 00000001 /f
275+
```
276+
277+
```console
278+
reg add "hklm\system\currentcontrolset\services\ntds\parameters" /v "Search Time Threshold (msecs)" /t reg_dword /d 00000001 /f
279+
```
280+
281+
```console
282+
reg add "hklm\system\currentcontrolset\services\ntds\diagnostics" /v "15 Field Engineering" /t reg_dword /d 00000005 /f
283+
```
284+
285+
When these settings take effect, all LDAP queries to AD DS generate instances of Event ID 1644. To support the increased log information, consider increasing the maximum size of the Directory Service log.
286+
287+
To continue the previous example, the query for "cn" and "ms-Mcs-AdmPwd" generates Event ID 3079, followed by Event ID 1644. Event ID 1544 resembles the following example:
288+
289+
```output
290+
Log Name: Directory Service
291+
Source: Microsoft-Windows-ActiveDirectory_DomainService
292+
Event ID: 1644
293+
Task Category: Field Engineering
294+
Level: Information
295+
Computer: dc25.contoso.com
296+
Description:
297+
Internal event: A client issued a search operation with the following options.
298+
299+
Client:
300+
10.32.51.5:54994
301+
Starting node:
302+
DC=contoso,DC=com
303+
Filter:
304+
(objectCategory=CN=Computer,CN=Schema,CN=Configuration,DC=contoso,DC=com)
305+
Search scope:
306+
subtree
307+
Attribute selection:
308+
ms-Mcs-AdmPwd,cn
309+
...
310+
User:
311+
Contoso\Admin
312+
```
313+
314+
You might also see Event ID 2041. This event indicates that duplicate log entries are suppressed. The event content resembles the following example:
315+
316+
```output
317+
Log Name: Directory Service
318+
Source: Microsoft-Windows-ActiveDirectory_DomainService
319+
Event ID: 2041
320+
Task Category: Internal Processing
321+
Level: Information
322+
Computer: dc25.contoso.com
323+
Description:
324+
Duplicate event log entries were suppressed.
325+
326+
See the previous event log entry for details. An entry is considered a duplicate if the event code and all its insertion parameters are identical. The time period for this run of duplicates is from the time of the previous event to the time of this event.
327+
328+
Event Code:
329+
80000c07
330+
Number of duplicate entries:
331+
7
332+
```
333+
334+
In this context, the information in these events indicates the following behavior:
335+
336+
- The request tries to inspect a confidential attribute on each of eight AD DS objects.
337+
- For each of the eight objects, the query results omit the confidential attribute.
338+
339+
To identify clients that used an unencrypted session, cross-reference the user details from Event ID 3079 to the query, the port details from Event ID 1644, and the client IP address.
340+
341+
To turn off verbose logging when you finish investigating, run the following commands:
342+
343+
```console
344+
reg delete "hklm\system\currentcontrolset\services\ntds\parameters" /v "Expensive Search Results Threshold" /f
345+
```
346+
347+
```console
348+
reg delete "hklm\system\currentcontrolset\services\ntds\parameters" /v "Inefficient Search Results Threshold" /f
349+
```
350+
351+
```console
352+
reg delete "hklm\system\currentcontrolset\services\ntds\parameters" /v "Search Time Threshold (msecs)" /f
353+
```
354+
355+
```console
356+
reg add "hklm\system\currentcontrolset\services\ntds\diagnostics" /v "15 Field Engineering" /t reg_dword /d 00000000 /f
357+
```

0 commit comments

Comments
 (0)