topic Re: NAC 4.7.2 in Network Security

NAC 4.7.2

estelamathew — Fri, 21 Feb 2020 12:06:53 GMT

Hello Dear's,

I m facing issues with single sign on only with Windows 7 , rest windows XP and vista in my network are working fine with single sign on.I m getting popup 2 times for user login in windows 7. My NAC agent version is 4.7.3.2. And NAC version is 4.7.(2)

where i m missing something???

Thanks,

Re: NAC 4.7.2

Tiago Antunes — Tue, 12 Oct 2010 12:15:00 GMT

Hi,

For windows 7 you need to do few things to make it work.

Please find detailed info here:

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/47/cas/s_adsso.html#wp1257882.

Hope this helps.

Tiago

==================

PS. If you found this usefull please rate it!! Thanks!

Re: NAC 4.7.2

estelamathew — Thu, 14 Oct 2010 10:23:38 GMT

Hello Tiago,

Just Need to confirm :

Enable Additional Algorithms on Existing AD Servers: For Windows 7

Question: Create a new AD SSO service account according to the guidelines in Add Active Directory SSO Auth Server, page 8-6. Cisco recommends that the current AD SSO account remain unchanged to allow you to quickly switch between the original DES encryption system and the this multi-algorithm option.

Answer: The Existing AD SSO which is already running for Windows XP ,vista should be as it is and i should create a New AD SSO Service account by same authentication type Active Directory SSO for Windows 7. ????? Please correct me if i m wrong????????

Question:Run KTPASS.EXE to allow multiple algorithms for this new service account
For Windows Server 2008:
KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

Answer After running the KTPASS account with the new username i have to modify the old user name of CAS which i have created in Manager and Active Directory. Please correct me if i m wrong????????

Question: Can i use the existing username and password of CAS that i used for running KTPASS.exe for XP and Vista. Only there will be changes in the end of the command.

Answer:KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

Thanks

Re: NAC 4.7.2

Tiago Antunes — Thu, 14 Oct 2010 10:29:06 GMT

Hi,

Basically there is no need to change the username when running the new ktpass, only to allow all crypto methods.

------------------------------------

Question: Can i use the existing username and password of CAS that i used for running KTPASS.exe for XP and Vista. Only there will be changes in the end of the command.

Answer:KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

-------------------------------------

Correct.

HTH,

Tiago

If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

Re: NAC 4.7.2

estelamathew — Thu, 14 Oct 2010 15:16:36 GMT

Hello Tiago

So conclusion is only to change the command –crypto All in KTPASS with the existing username and password.

KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

i will execute command tomorrow in NAC and i will update the ratings

Thank U.

Re: NAC 4.7.2

estelamathew — Sun, 17 Oct 2010 06:08:24 GMT

Hello Dear,

The below command should run in all Domain controllers primary and secondary?????? please correct me if i m wrong.

KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All.

Thanks

Re: NAC 4.7.2

Tiago Antunes — Sun, 17 Oct 2010 06:27:47 GMT

HI,

Nope, only in one DC is enough.

The DCs will then replicate the new user amongst each other.

If you have a single DC this is the command:

KTPASS.EXE –princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

If you have multiple DCs, then use the command refering only the domain itself:

KTPASS.EXE –princ newadsso/domain.com@DOMAIN.COM -mapuser newadsso –pass PasswordText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

Note that this command is if you have windows 2008 servers.

HTH,

Tiago

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Re: NAC 4.7.2

estelamathew — Sun, 17 Oct 2010 08:34:42 GMT

Dear Tiago,

I have multiple DC and as per ur previous mail u told me not to create a new user on exiting user just we have to run KTPASS command with -crypto ALL included

so from the following information:the command will be:

Computer name: koreaAD

domain: korea.com

nas user:cascisco

Nas Pass:cisco

SO I HOPE below will be the command.

KTPASS.EXE –princ cascisco/korea.com@korea.COM -mapuser cascisco –pass cisco –out c:\cascisco.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

Please confirm the above steps are correct.

Thanks

Re: NAC 4.7.2

Tiago Antunes — Sun, 17 Oct 2010 08:41:28 GMT

Hi,

Please take special attention to the case of the leters.

The syntaxe is case sensitive so please make sure you enter the correct leters on the domain for example.

Ibelieve it should be something like:

KTPASS.EXE –princ cascisco/korea.com@KOREA.COM -mapuser cascisco –pass cisco –out c:\cascisco.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

HTH,

Tiago

Re: NAC 4.7.2

estelamathew — Sun, 17 Oct 2010 09:20:02 GMT

Hello Expert,

U r the real expert,such crucial information can be given by only those u have worked a lot on NAC, Thanks for precious reply and hint on case sensitive,i will apply the command with the existing username and password and update the ratings.

Thanks,

NAC 4.7.2

truongthanhsang — Tue, 15 Nov 2011 09:31:50 GMT

Hello Tiago,

I'm configuring my NAC with Windows 2008 SP2.

I use ktpass file version 6.0.6002.18005

KTPASS.EXE –princ newadsso/domain.com@DOMAIN.COM -mapuser newadsso –pass Passw0rdText –out c:\newadsso.keytab –ptype KRB5_NT_PRINCIPAL –crypto All

But ADSSO Service still doesn't start. Plz help me!!

Thanks u so much!