v2.4.0

v2.4.0

The SPN check

Most "Kerberos failed, NTLM took over" cases have a boring cause: the service
name (SPN) the client asked for is not registered in Active Directory, is
registered on two accounts, or is registered for the real server name while
clients use an alias. The events already name the SPN; now the tool also asks
AD about it.

• New panel "Kerberos configuration (SPN)" in the Act block. Every SPN
  clients fell back to NTLM for, or that failed Kerberos with 0x7 ("server not
  found in Kerberos database"), is looked up in AD. The panel lists what is
  wrong, how much NTLM it causes, and the setspn command that fixes it, with
  a copy button and "Check again" for after the fix:
  • missing — no account holds the name (for instance a NAS that never
    joined the domain, or a stale name in a script)
  • alias — the name is a DNS alias (CNAME) or a short name; the SPN is
    registered for the real server, and the command registers it for the alias
  • duplicate — several accounts hold it, so the KDC refuses the ticket
    HOST/ registrations are taken into account through the forest's
    sPNMappings, so cifs/ or http/ on a computer account is not reported.
• Who looks it up: a domain controller running agent 2.4.0. The
  collector hands it up to 50 names in the answer to its status report; the
  agent queries the global catalog through ADSI and reports what it found.
  Read-only - any domain account may read servicePrincipalName, so no extra
  rights are needed. The tool never changes anything in AD; the command is
  for an admin to run. Each name is checked again after a day.
• ntlm-agent.exe spn-check <service/host>... runs the same lookup by
  hand and prints the result, on any domain-joined machine.
• Status report: SPN problems become a next step.

Security notes

The lookup runs a fixed PowerShell script (-EncodedCommand); the names reach
it through an environment variable, never the command line, and each is
checked against a strict service/host[:port] pattern first - no character
with a meaning in LDAP filters or PowerShell gets through. Results are only
accepted for names the collector actually handed out, and /spn needs the
API key like /ingest. "Check again" is a dashboard action with the same
cross-site protection as the work status.

Tests

• Collector: 14 more tests (67 in all) - SPN normalisation, every verdict,
  handing out and accepting only asked names, re-check, the report step.
• Agent: 6 more tests (34 in all) - input validation, output parsing, the
  encoding of the script.

Upgrading

1. Collector: replace ntlm-collector.py, restart, hard-refresh.
2. Agent 2.4.0 on at least one domain controller - that is where the
   lookup runs. Other machines gain nothing new; updating them is optional.

The AD lookup could only be tested against a simulated directory before
release. If a name shows up wrongly, ntlm-agent.exe spn-check <spn> on a DC
shows exactly what AD answered - please open an issue with its output.