topic Re: PIC identity mapping question about DCOM and WMI Registry key in Network Access Control

PIC identity mapping question about DCOM and WMI Registry key

csco11552159 — Wed, 11 Jul 2018 14:21:32 GMT

i m following the PIC document:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/pic_admin_guide/PIC_admin/PIC_admin_chapter_01000.html#task_784A7…

when we talk to our Corp Sec and ID team for changing registry key to allow our account with full control of DCOM/WMI key, they want to know the reason of the change. If we have Domain Admin account with read only access, will this do the work?

anyone can explain why we need full control?

this will be really help.

thank you.

Re: PIC identity mapping question about DCOM and WMI Registry key

csco11552159 — Wed, 11 Jul 2018 14:27:48 GMT

these 2 keys:

HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

Re: PIC identity mapping question about DCOM and WMI Registry key

hslai — Wed, 11 Jul 2018 17:19:04 GMT

In my earlier tests, it's to facilitate adding registry keys and values; that is, we won't be able to add the two registry keys (shown below) unless the administrators have the ownership and full control to "HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}".

reg add HKCR\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} /v AppID /t REG_SZ /d "{76A64158-CB41-11D1-8B02-00600806D9B6}"
reg add HKCR\AppID\{76A64158-CB41-11D1-8B02-00600806D9B6} /v DllSurrogate /t REG_SZ /d " "

IIRC, we need not touch the other key, the one under HKLM\Software, as it gets it from the first one.

Re: PIC identity mapping question about DCOM and WMI Registry key

csco11552159 — Wed, 11 Jul 2018 18:46:54 GMT

thank you. so if we manually created these keys, we can try to avoid "Full control", right ?

regarding the key is adding, for 64 bit is located at, right?

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} AppID = {76A64158-CB41-11D1-8B02-00600806D9B6}

Re: PIC identity mapping question about DCOM and WMI Registry key

hslai — Wed, 11 Jul 2018 20:59:46 GMT

I can't think of a way for us to avoid changing owner to "Administrators" with "Full Control" in order to perform the "reg add" operations successfully.

We might be able to revert the ownership change afterwards but I've never tried it myself.

Re: PIC identity mapping question about DCOM and WMI Registry key

csco11552159 — Thu, 12 Jul 2018 18:10:17 GMT

so we have to change all our DC's registry to make it work ,right?

will require the same setup for Server 16?

thank you.

Re: PIC identity mapping question about DCOM and WMI Registry key

hslai — Fri, 13 Jul 2018 04:17:05 GMT

Yes, if to use WMI providers directly, on all domain controllers, including Windows 2016 servers, to be monitored. If not using Easy Connect, you might want to consider installing PIC agents.