Kungani ikhompyutha ephathekayo ye-Protected Users idinga i-VPN ngaphambi kokungena

Ikhompyutha ephathekayo, i-akhawunti esebenzayo kanye nenethiweki yehhotela kuhlangene kwakha umjikelezo wokungena ongenakwephulwa yinoma yimuphi umzamo wokuphinda. I-akhawunti ise-Protected Users, okukuvimbayo ukuthi i-Windows igcine isiqinisekisi esasiyodingeka ukuze iqinisekise umsebenzisi ngaphandle koxhumano. Noma yiluphi uhlelo olunjengoluthi «ngena kuqala, bese uxhuma umhubhe kamuva» lunokulandelana okuhlanekezelwe, futhi isivikelo senza ngqo lokho esikuthembisile. Okulandelayo kucabanga i-akhawunti evamile ye-Active Directory kumgcini we-Windows osekelwe.

Yini isivikelo esiyisusa ngempela

Ngokuvamile i-Windows igcina isiqinisekisi endaweni yokugcina ukuze i-akhawunti yesizinda ikwazi ukungena ngesikhathi isilawuli sesizinda singafinyeleleki. I-Protected Users ivimbela lokho kuyo i-akhawunti, okususa ukungena esizindeni ngaphandle koxhumano njengethuba esikhundleni sokukwenza kungathembeki.

Lena akuyona inkinga evamile yendawo yokugcina endala, futhi amakhambi avamile awasebenzi lapha. Ukungena ku-inthanethi kaningi, ukushintsha iphasiwedi futhi noma ukunyusa inani lokungena okugciniwe ngeke kubuyisele lelo khono, ngoba akukho kulazo zenzo okwakha isiqinisekisi inqubomgomo eyenqabayo ukusigcina. I-akhawunti iziphatha ngendlela eyakhelwe ngayo, futhi umklamo uthatha ukuthi inethiweki ikhona lapho i-Windows ibuza. Ukuthatha uphawu njengokonakala kwendawo yokugcina yiyo indlela amaqembu agcina ekwakheni kabusha iphrofayela eyayingakaze yephuke.

Kungani umhubhe kufanele ube khona ngaphambi kwedesikithophu

Idivayisi kufanele ifinyelele ukuqinisekiswa kwesizinda ngesikhathi esithile i-Windows isicela, futhi lokho kungaphambi kokuba ibe khona noma iyiphi iseshini yomsebenzisi. Iklayenti le-VPN eliqala kuphela ngemva kokuvela kwedesikithophu lishiya ukungena okusha kulindele indlela engalokothi ifike. Ukuncika kungokomshini, hhayi kungokomsebenzisi ongakangenanga.

Sebenzisa ilungiselelo elisekelwe langaphambi kokungena elivunyelwene nabanikazi bezindawo zokugcina kanye nobuwena. Umhubhe wedivayisi we-Always On VPN oqinisekiswa ngesitifiketi sekhompyutha ufanelekile lapho idivayisi elawulwayo ihlangabezana nemibandela yokuqala yalokho kusetshenziswa. Ukuhlanganiswa kwesikrini sokungena okusekelwe umhlinzeki kungenye indlela. Iphrofayela yomsebenzisi evamile enomthombo ozenzakalelayo akuyona neyodwa yazo, noma ngabe ibukeka ifana kangakanani kusihlanganisi seklayenti.

Leyo ndlela idinga ukuxazululwa kwamagama esizinda, isilawuli sesizinda esifinyelelekayo kanye namaphrothokholi okuqinisekisa i-akhawunti engawasebenzisa, futhi asikho isibonisi esithi «ixhunyiwe» esinikeza noma yikuphi kwalokho. Imizila yayo nezihlungi kufanele zithwale izinsizakalo zobuwena hhayi enye into engadingekile, ngoba lolo hlu lweziqalo yisimo ikhompyutha ephathekayo ebiwe ethola kulo ngaphambi kokuba noma ubani angene. Izinqumo zomhubhe ohlukanisiwe ezenzelwa umhubhe womsebenzisi azisebenzi kumhubhe wedivayisi, ngakho hlola kokubili ngokwehlukana.

Ukufinyeleleka akukona ukuhambisana kokuqinisekisa

Umhubhe ungathwala amaphakethe kahle kakhulu kuyilapho ukuqinisekiswa kwesizinda kwehluleka, ngoba indlela ezanywa iyona i-akhawunti engayisebenzisi. Esizindeni esiphoqelela imikhawulo yeqembu, i-NTLM ayitholakali kumalungu futhi i-Kerberos idinga i-akhawunti nokulungiselelwa okuhambisana ne-AES. Indlela yamaphakethe ayikwazi ukulungisa noma yikuphi kwalokho. Yikho ukuthi i-ping ehlanzekile kwisilawuli sesizinda akubona ubufakazi bokuthi ukungena kuzosebenza.

Kungase kube khona nezinhlelo ezimbili zobufakazi. I-VPN ingaqinisekisa kumhlinzeki wobuwena kuyilapho i-Windows idinga ngokwehlukana ukungena kwesizinda, futhi ukwamukelwa kwakho kokuqala akusho lutho ngokwesibili. «I-VPN ixhumile» kanye «nomsebenzisi ungene» kuyimibono ehlukene, futhi ukulungisa okunye akusho okunye.

Funda ubufakazi bokuqinisekisa

Qoqa izehlakalo kusuka kuklayenti nakusilawuli sesizinda ngomzamo ofanayo, hhayi ohlangothini olulodwa kuphela. Amalogi e-Protected Users angaphansi kwe-Applications and Services Logs\Microsoft\Windows\Authentication, futhi umlawuli kungase kudingeke avule ilogi ngaphambi kokuba libhale noma yini. Hlanganisa izimpawu zesikhathi nelogi yoxhumo yomhubhe uqobo, ngoba iphutha lokulandelana libonakala njengokonakala kobufakazi kuzo zombili izinhlangothi.

Umyalo wokuqala ngezansi ubala yonke ilogi yokuqinisekisa edalulwa idivayisi, ngakho ufunda ekhona hhayi leyo eqanjwe iposi le-blogi. Owesibili ufunda okufakiwe kwakamuva uma usuwazi igama. Dinga iphakethe lokuqinisekisa, i-akhawunti kanye nesimo sokwehluleka, ngoba indlela yenethiweki engekho kanye nendlela enqatshiwe kushiya ubufakazi obuhlukene futhi kukodwa kuphela kubo okuyinkinga ye-VPN. Uma umhubhe ukhuphuka ngemva komzamo, ukulandelana kwakungalungile noma ngabe uthini lowo mbhalo.

Get-WinEvent -ListLog *Authentication*
Get-WinEvent -LogName Microsoft-Windows-Authentication/Operational -MaxEvents 20

Fakazela umngcele kusukela ekuqalweni okubandayo

Gijimisa ukuhlolwa kusukela esimweni sokuphuma noma esanda kuqalwa nge-akhawunti enomkhawulo, futhi ugcine indlela yokubuyisela evunyelwe ivuliwe ngaphambi kokushintsha noma yini kubasebenzisi abanamalungelo akhethekile. Ukuhlolwa kwidesikithophu esivele sisebenza akuzilolonga nezingxenye zendlela yekhodi ebalulekile, futhi lokho kuchaza imibiko eminingi mayelana nokulungiswa okwahlala kwaze kwaba ukuqalwa okulandelayo. Bese udlula izinyathelo ezine ngokulandelana lokhu.

1. Qinisekisa ukuthi idivayisi ingathola isilawuli sesizinda ngaphambi kokuba noma ubani angene, nge-nltest /dsgetdc:corp.example.com.
2. Zama ukungena esizindeni, bese ubuza ukuthi ngabe ithikithi latholakala nhlobo yini, nge-klist.
3. Funda ilogi yokuqinisekisa erekhodwa idivayisi, ngemiyalo emibili engenhla, futhi uqaphele iphakethe nesimo sokwehluleka.
4. Qinisekisa ukuthi ubufakazi bokubuyisela obuvunyelwe busasebenza kusukela kusikrini sokungena, ngoba yiyo kuphela indlela yokubuyela uma ukuhlolwa komngcele kwehluleka.

Ukuvula ukwabelana ngefaekili ngobufakazi obunikeziwe nakho akudali ukungena okusebenzisanayo ngaphandle koxhumano, ngakho akuthathi indawo yanoma isiphi isinyathelo esingenhla. Uma inhlangano idinga ngempela ukungena ngaphandle koxhumano, impendulo iwumklamo ohambisanayo we-akhawunti nendawo yokugcina okhethwe ngamabomu. Ukukhipha i-akhawunti eqenjini, noma ukugcina ukungena okuphuthumayo okungavinjelwe kuyo yonke ikhompyutha ephathekayo, yisinqumo senqubomgomo yobuwena i-VPN engeke ikwazi ukusithathela wena.

Imibhalo ye-Protected Users ichaza kokubili ukuziphatha kwesiqinisekisi kanye nemikhawulo yesizinda umklamo lo oncike kuyo. Hlela inqubo yokubuyisela ngaphambi kokuba noma ubani ahambe, ngoba ukuhlolwa kokuqalwa okubandayo yiyo kuphela indawo okuzilolonga kuyo.