Asp site works with Win7 IE 11 but not with Win10 IE11

Question

so we have this old asp site (that just won't die).

It's currently sitting on win2k12, it's setup with spn's and kerberos delegation. It uses a Com+ object that runs a .vbs that does a lot of talking with active directory.

We are starting to roll out our windows 10 implementation.

In our dev environment, it works with win7/IE11 and win10/IE11 In our production environment, win7/IE11 has worked (and still does) but win10/IE11 is not working.

Some of the error messages are

Active Directory error '80040e37'
The specified directory service attribute or value does not exist.

Error getting attribute max range
Attribute: [givenName]
Error description: [-2147463153] The attempted action violates the DS schema rules.

Normally these would point to the website not being configured properly but it's working fine for everyone on win7.

So that would point the finger towards the win10 implementation.

What in windows 10 would be causing this issue? (Maybe a specific misconfigured gpo?) I'm stumped.

Update 1-.

GPOs don't seem to the problem. It's the same gpo set regardless if it's win7 or win10 (no filtering by wmi).

So the site works in Windows8/ie11 and it also works in Chrome on win7 (after a few tweaks to enable kerberos)

I've managed to create a little test page that cause the issue.

Dim oSysInfo 
 dim user
    'on error resume next 
    'Get the Current Users information.  This information is just the currently logged on user
'  Set oSysInfo = Server.CreateObject("ADSystemInfo")
  'Get Current User Object  
    sURL= "LDAP://AUsersDistinguishedName"
    response.write(sURL & "<br />")
on error resume next
    Set user = GetObject(sURL)

    pAttribute = "givenName"
    'response.write(user.get(pAttribute))

     Dim cl, sc, pr, pr2, pAttribute
     Set cl = GetObject(user.Schema)

    'Test(user)
         Set sc = GetObject(cl.Parent)     

       Set pr = sc.GetObject("Property", pAttribute)  

       response.write(pr.MaxRange)

       Set cl = Nothing
       Set sc = Nothing
       Set pr = Nothing 

  '-2147463155: Not found in directory cache, that means the MaxRange property is empty or not set, so there is no error
  if err.number <> 0 and err.number <> -2147463155 then 
     Response.Write "<br>Error description: [" & err.number & "] " & err.Description
  End If

--- Update 2.

I'll add more information about the IIS server.

Server has 2 spn that point from the URL to the server
The server is setup for delegation.
The application pool is run on a specific domain account. It is set to 32bit.
Windows Authentication is the only enabled authentication. (Extended Protection is off and enable Kernel-mode authentication is enabled). Negociate is the first enabled provider. Ntlm is the second.

Update 3: I've gotten Microsoft involved with one of my msdn incident. When we did a network monitoring trace, there seems to be an issue with kerberos.

Working - dev with windows10 Ticket: Realm: ourRealm, Sname: ldap/DomainControllerFQN

Working - Prod with windows7 Ticket: Realm: ourRealm, Sname: ldap/DomainControllerFQN

Not working - Prod with windows10 Ticket: Realm: ourRealm, Sname: Name of account running the website. all the request falls to NLMP ( ntlm) and not using kerberos

As for spn, they are the same between both environments. When we do setspn -l Webserver, this is a subset of them.

http/WebsiteFQN -- We added this when we deployed to win2k12, 3 years ago
http/websiteName -- We added this when we deployed to win2k12, 3 years ago
TERMSRV/ServerName
TERMSRV/WebserverFqn
WSMAN/WebServerFqn
WSMAN/WebServer
RestrictedKrbHost/WebServer
HOST/WebServer
RestrictedKrbHost/WebServerFqn
HOST/WebServerFqn

On the delegation tab for the webserver, it's set to

"Trust this computer for delegation to any service (Kerberos only)"

Here are screenshots of the IIS Authentication section

-- Update 4

here are the output of the Klist information after hitting the website in both environments (I did a klist purge on the workstation before hand)

Windows 10 - dev - working

Cached Tickets: (4)

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x60a00000 -> forwardable forwarded renewable pre_authent 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x2 -> DELEGATION 
    Kdc Called: DomainControllerFqn

#1> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x1 -> PRIMARY 
    Kdc Called: DomainControllerFqn

#2> Client: MyUser @ DomainFqn
    Server: cifs/resourceServer @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a00000 -> forwardable renewable pre_authent 
    Start Time: 11/28/2017 10:27:11 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

#3> Client: admlareaua @ DomainFqn
    Server: HTTP/webserverFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

Windows 10 - Prod- Not working

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 9:14:10 (local)
    End Time:   11/28/2017 19:14:10 (local)
    Renew Time: 12/5/2017 9:14:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x1 -> PRIMARY 
    Kdc Called: DomainControllerFqn

#1> Client: admhqlareaua @ DomainFqn
    Server: HTTP/WebServerFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 9:14:10 (local)
    End Time:   11/28/2017 19:14:10 (local)
    Renew Time: 12/5/2017 9:14:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

Windows 7 - Prod- Working

Cached Tickets: (3)

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x60a00000 -> forwardable forwarded renewable pre_authent 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96


#1> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96


#2> Client: MyUser @ DomainFqn
    Server: HTTP/WebServerFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96

Update 5 -

So for run, i created a quick mvc site and put it as a sub site to the non working site.

I made the following controller.

public JsonResult GetList2()
{
    var st = new List<string>();

    var currSchema = ActiveDirectorySchema.GetCurrentSchema();
    st.Add(currSchema.Name);

    foreach (ActiveDirectorySchemaProperty property in currSchema.FindAllProperties())
    {
        st.Add($"{property.Name} - {property.RangeUpper}");
    }

    return Json(st, JsonRequestBehavior.AllowGet);
}

It seems to work fine and gives me the maxlength values I want. So I think i'm going to throw in the towel on this issue and continue with the re-write to c# of the application.

Update - 6 (6 months later).

It turns out that the issue is with Credential guard. (another old application was starting to get the same type of issue)

We turned off credential guard in the registry and the application worked fine.

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-considerations

(from the link)

Kerberos Considerations

When you enable Windows Defender Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. Use constrained or resource-based Kerberos delegation instead

So I'll have to look into I guess constrained or resource-based Kerberos

"*Server has 2 spn that point from the URL to the server.*" So what are those two SPNs? Add that to your question and also add a screenshot showing exactly how you delegated. — T-Heron, Nov 24 '17 at 00:51
Hi T-Heron, I've added more detail for you. I'll update the thread once I get more information from Microsoft. — Lareau, Nov 24 '17 at 13:21
I might not need to wait for Microsoft, if you can just add a screenshot of the delegation tab for the webserver, shown with the "Expanded" checkbox at the bottom of that tab marked. That would be very helpful. — T-Heron, Nov 24 '17 at 14:31
I've added the screenshot. When I check the expanded checkbox, nothing changes in the screenshot. This is the same for both dev and prod. — Lareau, Nov 24 '17 at 14:35
I apologize, I have a little less experience with IIS and ASP. To what is IIS delegating, to ASP or to something else? Can we also see full output of *setspn -l Webserver*? Please update question with full output. — T-Heron, Nov 24 '17 at 15:20
I've added all the SPN and the 2 that were added when the website was moved to 2012. IIS seems to be passing the credentials of the user to the website to be able to do changes to AD. The application pool of the website has no permissions to change anything in AD. — Lareau, Nov 24 '17 at 15:46
Is IIS doing Kerberos delegation to the ASP application, or delegating to something else? — T-Heron, Nov 24 '17 at 16:47
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/159767/discussion-between-lareau-and-t-heron). — Lareau, Nov 24 '17 at 17:08
Nope, i've been transferred from the keberos premier person to a iis/asp.net person at microsoft. i'll be sure to update once i have an answer — Lareau, Jan 15 '18 at 13:18

score 0 · Accepted Answer · answered Jun 26 '18 at 18:25

0

So credential guard seems to be the big culprit. I've opened up another question to try and point point that issue - Switching application to use Constraint based kerberos

answered Jun 26 '18 at 18:25

Lareau

1,982
1
26
47

Asp site works with Win7 IE 11 but not with Win10 IE11

1 Answers1