Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Update faq.yml to fix wrong information cloud trust compatibility with RODC #12005

Merged
merged 3 commits into from
Feb 12, 2025
Merged

Update faq.yml to fix wrong information cloud trust compatibility with RODC #12005

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5ea3075
Update faq.yml to fix wrong information cloud trust compatibility wit…
ChunlinXuMSFT Feb 11, 2025
60df47a
Clarify RODC support for cloud Kerberos trust
paolomatarazzo Feb 12, 2025
494304b
Fix indentation in FAQ answer text
paolomatarazzo Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions windows/security/identity-protection/hello-for-business/faq.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,9 +210,9 @@ sections:
- question: Does Windows Hello for Business cloud Kerberos trust work in my on-premises environment?
answer: |
This feature doesn't work in a pure on-premises AD domain services environment.
- question: Does Windows Hello for Business cloud Kerberos trust work in a Windows sign-in with RODC present in the hybrid environment?
- question: Does Windows Hello for Business cloud Kerberos trust work with RODC present in the hybrid environment?
answer: |
Windows Hello for Business cloud Kerberos trust looks for a writeable DC to exchange the partial TGT. As long as you have at least one writeable DC per site, login with cloud Kerberos trust will work.
Windows Hello for Business cloud Kerberos trust functions correctly when the client authenticates directly to a writable domain controller or to a Read-Only Domain Controller (RODC) that doesn't cache the user's credentials, in accordance with the Password Replication Policy. If the client attempts to authenticate to an RODC that can cache the user's credentials, cloud Kerberos trust authentication might fail. To mitigate this, deploy KDC certificates to all RODCs to support Windows Hello for Business key trust authentication, which is also required for those RODCs to support LDAP over SSL. This configuration ensures that authentication can seamlessly failover to Windows Hello for Business key trust authentication, thereby guaranteeing successful user authentication.
- question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust?
answer: |
Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when:
Expand Down