Solved

AD Security permissions that allow registry modification

Posted on 2009-04-01
6
286 Views
Last Modified: 2013-12-24
I have an issue where our users are authenticating onto a Citrix Secure Access Gateway website to access a published application and receiving error messages pointing to SSL connection failures.

I have narrowed it down to the point where if the users are in the administrators AD member group this published app will load fine for them. However if they are not in this group (and obviously I do not want users in this group) then they receive the error messages when trying to launch the published app.

I am therefore creating a new AD member group and wish to isolate just the security permissions the administrators account uses to read/write to the registry as I believe this Citrix Access Gateway site writes a file to the registry.

Any suggestions would be greatly appreciated
0
Comment
Question by:MartynLawson
  • 3
  • 3
6 Comments
 
LVL 11

Expert Comment

by:snoopfrogg
ID: 24039166
For permissions related issues like this where you need to determine where an access denied is occurring, I like to use Windows Sysinternal Process Monitor:  http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx.  Run the app as a non-admin user, then filter by access denied entries.  You'll be able to see where the user is lacking permission, helping you avoid having to grant the user too much access.
0
 
LVL 1

Author Comment

by:MartynLawson
ID: 24047977
I have tried that and it is showing no access denied errors, but there are plenty of entries showing Not Found. Do you think that this might be causing the problem?
0
 
LVL 11

Expert Comment

by:snoopfrogg
ID: 24049978
I generally ignore the "Not Found" entries and focus on the "Access Denied" entries when troubleshooting permissions-related issues.  Are you running Process Explorer on the server running Citrix Secure Access Gateway?  You'll want to do so as end users are access resources on the server rather than their own workstations.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 1

Author Comment

by:MartynLawson
ID: 24050035
Unfortunatel the server running the gateway is owned and maintained by a third party and therefore we are only able to do diagnostics from the client side of things. Do you know of any further diagnostics that we would be able to perform from the client side?
0
 
LVL 11

Assisted Solution

by:snoopfrogg
snoopfrogg earned 100 total points
ID: 24050441
That makes troubleshooting this pretty difficult unless the third party is willing to help out.  I think you hit the nail on the head when you indicated you need to determine where exactly in the registry data is being written.  By isolating the key or keys being written, you avoid having to grant too much access.  

One other option, if you don't want to involve the third party, is placing a call to Citrix to see if they can tell you what permissions are needed.  Once you know this, you can pass on the information to the third party and ask them to modify the registry's permissions accordingly.
0
 
LVL 1

Accepted Solution

by:
MartynLawson earned 0 total points
ID: 24094808
I have found out that this issue causing this is a GPO that is not being applied correctly. I have since enforced the GPO and it seems to be picking up the settings.

Thanks for assisting me in diagnosing the problem

Kind Regards

Martyn
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Table where row act as column 11 68
DSRM password 5 41
DNS forwarders "unable to resolve" 1 55
error doing substr 3 33
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question