Skip to main content
chrisW4
chrisW4
Explorer II
November 9, 2023
Question

KDC Proxy

  • November 9, 2023
  • 2 replies
  • 5083 views

It looks like only with KDC Proxy setup my SMB Shares can be accessed by ZTNA Users.

Problem is that the KDC Proxy Setup is not very well described nor I find a detailled description on the web that helps me figure out enough details.

 

There is this Fortinet article

 

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/553746/ztna-access-proxy-with-kdc-to-access-shared-drives

 

And I also found this for KDC setup.

 

https://syfuhs.net/kdc-proxy-for-remote-access

 

My biggest question is, what is the correct URL that needs to be entered in the client Group policy so KDC Proxy is reached.

Another question is if and how I can 

2 replies

Hatibi
Staff & Editor
Hatibi
Staff & Editor
November 10, 2023

Hi Christoph,

 

the guide you shared actually specifiec the registry settings to be applied:

 

Configuring registry keys on clients

If you are trying to deploy these settings on a client machine that cannot retrieve group policy updates, manually configure the registry keys for the client:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos] "KdcProxyServer_Enabled"=dword:00000001 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\KdcProxy\ProxyServers] "*"="<https kdcproxy.fortitest.net />" or ".fortitest.net"="<https kdcproxy.fortitest.net />"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters] "NoRevocationCheck"=dword:00000000

 

Regards

    chrisW4
    chrisW4Author
    Explorer II
    November 20, 2023

    In the client registry there is no Kerberos Section at all

    chrisW4
    chrisW4Author
    Explorer II
    November 27, 2023

    I managed to use Kerbereos now!

     

    Problem is that my network drives are defined in group policys.

    So when connecting via ZTNA the drives are not reconnected.

     

    Is there another port or Service that can be used via ZTNA to apply group policys?

    Only option at the moment is to enter

     

    net use * /delete /y

    Then I can connect a drive again manually.

     

      nsgill
      nsgill
      New Member
      January 5, 2024

      Hi Christian,

       

      Is SMB driving working for you now without prompting for username and password through ZTNA.

        chrisW4
        chrisW4Author
        Explorer II
        January 9, 2024

        Only when I connect new shares, existing ones that were connected within domain are not reconnected at all

        Terms & ConditionsAccessibility statement
        Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.