AWS directoryservice medium security documentation change
Summary
Added troubleshooting guidance for AD Connector creation errors, service account credential issues, and general diagnostic tools. Expanded documentation on Kerberos time synchronization, LDAPS certificate validation, network configuration checks, and Active Directory indexing requirements.
Security assessment
The changes address security-sensitive scenarios such as expired LDAPS certificates (which could compromise secure communication) and Kerberos time synchronization failures (critical for authentication validity). The documentation explicitly guides users to validate certificates, ensure time synchronization, and configure secure network settings, directly impacting authentication security.
Diff
diff --git a/directoryservice/latest/admin-guide/ad_connector_troubleshooting.md b/directoryservice/latest/admin-guide/ad_connector_troubleshooting.md index 844fdc57b..c9ec4e2e5 100644 --- a//directoryservice/latest/admin-guide/ad_connector_troubleshooting.md +++ b//directoryservice/latest/admin-guide/ad_connector_troubleshooting.md @@ -5 +5 @@ -Creation issuesConnectivity issuesAuthentication issuesMaintenance issuesI cannot delete my AD Connector +Creation issuesConnectivity issuesAuthentication issuesMaintenance issuesI cannot delete my AD ConnectorGeneral tools for investigating AD Connector issuers @@ -22,0 +23,2 @@ The following can help you troubleshoot some common issues you might encounter w + * General tools for investigating AD Connector issuers + @@ -59,0 +62,26 @@ If your AD Connector does not meet these requirements, recreate your AD Connecto +### I receive "An internal service error has been encountered while connecting the directory. Please retry the operation." error when I create an AD Connector + +This error usually occurs when the AD Connector fails to create and can’t connect to a valid domain controller for your self-managed Active Directory domain. + +###### Note + +As a [best practice](./ad_connector_best_practices.html#ad_connector_config_onprem), if your self-managed network has Active Directory Sites defined, you must ensure the following: + + * The VPC subnets where your AD Connector resides are defined in an Active Directory Site. + + * No conflicts exist between your VPC subnets and the subnets in your other sites. + + + + +AD Connector uses the Active Directory Site whose subnet IP address ranges are close to those in the VPC that contain the AD Connector to discover your AD domain controllers. If you have a site whose subnets have the same IP address ranges as those in your VPC, AD Connector will discover the domain controllers in that site. The domain controller may not physically be close to the Region your AD Connector resides in. + + * Inconsistencies in DNS SRV records (These records use the following syntax: `_ldap._tcp._< DnsDomainName>_` and `_kerberos._tcp.<DnsDomainName>`) created in customer managed Active Directory domain. This can occur when AD Connector couldn’t find and connect to a valid domain controller based on these SRV records. + + * Networking issues between AD Connector and customer managed AD such as firewall devices. + + + + +You can use [network packet capture](https://techcommunity.microsoft.com/blog/iis-support-blog/capture-a-network-trace-without-installing-anything--capture-a-network-trace-of-/376503) on your domain controllers, DNS servers, and VPC flow logs of directory network interfaces to investigate this issue. Contact [AWS Support](https://docs.aws.amazon.com/awssupport/latest/user/case-management.html) for further assistance. + @@ -75,4 +103 @@ If your AD Connector does not meet these requirements, recreate your AD Connecto -You receive an error message similar to the following when connecting to your on-premises directory: - - - Connectivity issues detected: LDAP unavailable (TCP port 389) for IP: <IP address> Kerberos/authentication unavailable (TCP port 88) for IP: <IP address> Please ensure that the listed ports are available and retry the operation. +You receive an error message similar to the following when connecting to your on-premises directory: **`Connectivity issues detected: LDAP unavailable (TCP port 389) for IP:`<IP address>` Kerberos/authentication unavailable (TCP port 88) for IP: `<IP address>` Please ensure that the listed ports are available and retry the operation.`** @@ -141,7 +166 @@ AD Connector needs to obtain the `_ldap._tcp.`<DnsDomainName>`` and `_kerberos._ -You receive an error message similar to the following when you try to sign in to your WorkSpaces with a smart card: - - - **ERROR** : Certificate Validation failed. - Please try again by restarting your browser or application and make sure you select the correct certificate. - -The error occurs if the smart card’s certificate is not properly stored on the client that uses the certificates. For more information on AD Connector and smart card requirements, see [Prerequisites](./ad_connector_clientauth.html#prereqs-clientauth). +You receive an error message similar to the following when you try to sign in to your WorkSpaces with a smart card: **`**ERROR** : Certificate Validation failed. Please try again by restarting your browser or application and make sure you select the correct certificate.`** The error occurs if the smart card’s certificate is not properly stored on the client that uses the certificates. For more information on AD Connector and smart card requirements, see [Prerequisites](./ad_connector_clientauth.html#prereqs-clientauth). @@ -243,0 +263,102 @@ This can occur if the hard drive on your domain controller runs out of space. En +### I receive "An error has occurred" or "An unexpected error" when I try to update the AD Connector service account + +The following errors or symptoms occur while searching users in AWS Enterprise Applications such as [Amazon WorkSpaces Console Launch Wizard](https://docs.aws.amazon.com/workspaces/latest/adminguide/launch-workspace-ad-connector.html#create-workspace-ad-connector): + + * **`An Error Has Occurred. If you continue to experience an issue contact the AWS Support Team on the community forums and via AWS Premium Support.`** + + * **`An Error Has Occurred. Your directory needs a credential update. Please update the directory credentials.`** + + + + +If you try to update your AD Connector service account credentials in AD Connector, you might receive the following errors messages: + + * **`Unexpected error. An unexpected error occurred.`** + + * **`An error occurred. There was an error with the service account/password combination. Please try again.`** + + + + +The AD Connector directory’s service account resides in the customer managed Active Directory. The account is used as an identity to perform queries and operations on the customer managed Active Directory domain through the AD Connector on behalf of AWS Enterprise Applications. AD Connector uses Kerberos and LDAP to perform these operations. + +**The following list explains what these error messages mean:** + + * There could be an issue with the time synchronization and Kerberos. AD Connector sends Kerberos authentication requests to Active Directory. These requests are time sensitive and if the requests are delayed, they will fail. Ensure that there is no time-sync issues between any of the customer managed domain controllers. To resolve this issue, see [ Recommendation - Configure the Root PDC with an Authoritative Time Source and Avoid Widespread Time Skew](https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew) in Microsoft documentation. For more information about time service and synchronization, see the following: + + * [How the Windows Time Service Works](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works) + + * [Maximum tolerance for computer clock synchronization](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization) + + * [Windows Time service tools and settings](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings?tabs=config) + + * An intermediate network device, with a network [MTU](https://support.microsoft.com/en-us/topic/the-default-mtu-sizes-for-different-network-topologies-b25262c5-d90f-456d-7647-e09192eeeef4) restriction, such as Firewall or VPN hardware configurations, between the AD Connector and customer managed domain controllers, can cause this error due to [network fragmentation](https://en.wikipedia.org/wiki/IP_fragmentation). + + * To verify the MTU restriction, you can perform a [Ping test](https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/mtu-size-matters/1025286) between your customer managed domain controller and an Amazon EC2 instance that is launched in one of your directory subnets that is connected via AD Connector. The frame size should be no larger than the default size of 1500 Bytes + + * The ping test will help you to understand whether the frame size is more than 1500 bytes (also known as Jumbo frames) and they are able to reach the AD Connector VPC and subnet without the need of fragmentation. Further verify with your network team and ensure that Jumbo frames are allowed on the intermediate network devices. + + * You may face this issue, if [client-side LDAPS](./ad_connector_ldap_client_side.html) is enabled on AD Connector, and the certificates are expired. Ensure both server side certificate and CA certificate are valid, haven’t expired, and meets the requirements as per the [LDAPs documentation](./ad_connector_ldap_client_side.html#prereqs-ldap-client-side). + + * If [Virtual List View Support](https://learn.microsoft.com/en-us/windows/win32/controls/use-virtual-list-view-controls) is disabled in customer managed Active Directory domain, then AWS Applications will not be able to search users because AD Connector uses VLV search in LDAP queries. Virtual List View Support is disabled when the DisableVLVSupport is set to non-zero value. Ensure the [Virtual List View (VLV) Support](https://learn.microsoft.com/en-us/previous-versions/office/exchange-server-analyzer/cc540446\(v=exchg.80\)?redirectedfrom=MSDN) is enabled in Active Directory using the following steps: + + 1. Login to the Domain Controller as the schema master role owner using an account with Schema Admin credentials. + + 2. Select **Start** and then **Run** , and enter `Adsiedit.msc`. + + 3. In the ADSI Edit tool, Connect to **Configuration Partition** , and expand the **Configuration[DomainController]** node. + + 4. Expand the**CN=Configuration,DC=DomainName** container. + + 5. Expand the **CN=Services** object. + + 6. Expand the **CN=Windows NT** object. + + 7. Select the**CN=Directory Service** object. Select **Properties**. + + 8. In the Attributes list, select **msds-Other-Settings**. Select**Edit**. + + 9. In the Values list, select any instance of **DisableVLVSupport=x** where x is not equal to **0** , and select **Remove**. + + 10. After removing, enter `DisableVLVSupport=0`. Select **Add**. + + 11. Select **OK**. You can close the ADSI Edit tool. The following image shows the Multi-valued String Editor dialog box in the ADSI Edit window: + + + +###### Note + +In large Active Directory infrastructure with more than 100,000 users, you might only be able to search specific users. However, if you try to list all the users (For example, **Show All Users in WorkSpaces Launch Wizard**) at once, it might result in the same error even if VLV Support is enabled. AD Connector requires the results to be sorted for attribute "CN" using Subtree Index. The Subtree Index is the type of index which prepares the domain controllers for performing a Virtual List View (LDAP) search operation that allows AD Connector to complete a sorted search. This index improves the VLV search and prevents the use of the temporary database table called [MaxTempTableSize](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/view-set-ldap-policy-using-ntdsutil). The size of this table can vary, but by default the maximum number of entries is 10000 (the MaxTempTableSize setting of the Default Query Policy). Increasing the MaxTempTableSize is less efficient than using the Subtree Indexing. To avoid these errors in large AD environments, it is advised to use Subtree Indexing. + + + + +You can enable the Subtree index by modifying the [searchflags](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/mcm-active-directory-indexing-for-the-masses/ba-p/255867) attribute on the attribute definition, in the Active Directory schema, with a value of 65 (0x41), using ADSEdit as per the following steps: + + 1. Login to the Domain Controller as the schema master role owner using an account with Schema Admin credentials. + + 2. Select **Start** and **Run** , enter `Adsiedit.msc`. + + 3. In the ADSI Edit tool, connect to**Schema Partition**. + + 4. Expand the **CN=Schema,CN=Configuration,DC=DomainName** container. + + 5. Locate the "**Common-Name** " attribute and right-click and select **Properties**. + + 6. Locate the **searchFlags** attribute and change its value to `65 (0x41)` for enabling SubTree indexing along with normal Index. + +The following image shows the CN=Common-Name properties dialog box in the ADSI Edit window: + + + + 7. Select **OK**. You can close the ADSI Edit tool. + + 8. For the confirmation, you should be able to see an event ID 1137 ( Source : Active Directory_DomainServices), which indicates that the AD has successfully created the new index for the specified attribute. + + + + +For more information, see [Microsoft documentation](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/mcm-active-directory-indexing-for-the-masses/ba-p/255867). + +Show moreShow less + @@ -246 +367 @@ This can occur if the hard drive on your domain controller runs out of space. En -You may experience errors when searching for users while using AWS applications, such as WorkSpaces or Amazon QuickSight, even while the AD Connector status was active. Expired credentials can prevent AD Connector from completing queries on objects in your Active Directory. Update the password for the service account using the ordered steps provided in Seamless domain join for Amazon EC2 instances stopped working. +You may experience errors when searching for users or logging into AWS applications, such as WorkSpaces or QuickSight, even while the AD Connector status was active. If the AD Connector's service account's password has been changed or is expired, AD Connector can no longer query the Active Directory domain. Contact your AD Administrator and verify the following: @@ -248 +369 @@ You may experience errors when searching for users while using AWS applications, -### I receive an error about my directory credentials when I try to update the AD Connector service account + * Check the AD Connector service account password has not expired @@ -250 +371 @@ You may experience errors when searching for users while using AWS applications, -You receive an error message similar to one or more of the following when trying to update the AD Connector service account: + * Checked the AD Connector service account does not have the option **User must change password at next logon** enabled. @@ -251,0 +373 @@ You receive an error message similar to one or more of the following when trying + * Check the AD Connector service account is not locked. @@ -253,2 +375 @@ You receive an error message similar to one or more of the following when trying - Message:An Error Has Occurred - Your directory needs a credential update. Please update the directory credentials. + * If you’re not sure whether the password is expired or changed, you can reset the service account password and also [update](./ad_connector_update_creds.html) the same password in AD Connector. @@ -257,3 +377,0 @@ You receive an error message similar to one or more of the following when trying - An Error Has Occurred - Your directory needs a credential update. Please update the directory credentials - following Update your AD Connector Service Account Credentials @@ -262,4 +380,5 @@ You receive an error message similar to one or more of the following when trying - Message: - An Error Has Occurred - Your request has a problem. Please see the following details. - There was an error with the service account/password combination +### I receive an error about my directory credentials when I try to update the AD Connector service account + +You receive an error message similar to one or more of the following when trying to update the AD Connector service account: + +**`Message:An Error Has Occurred Your directory needs a credential update. Please update the directory credentials.`** **`An Error Has Occurred Your directory needs a credential update. Please update the directory credentials following Update your AD Connector Service Account Credentials`** **`Message: An Error Has Occurred Your request has a problem. Please see the following details. There was an error with the service account/password combination`** @@ -319,0 +439,21 @@ If your AD Connector switches to an inoperable state, you no longer have access +## General tools for investigating AD Connector issuers + +The following tools can be used to troubleshoot various AD Connector issues related to creation, authentication, and connectivity: + +**DirectoryServicePortTest tool** + + +The [DirectoryServicePortTest](samples/DirectoryServicePortTest.zip) testing tool can be helpful when troubleshooting connectivity issues between AD Connector and customer managed Active Directory or DNS servers. For more information on how to use the tool, see [Test your AD Connector](./ad_connector_getting_started.html#connect_verification). + +**Packet capture tool** + + +You can use the built-in Windows package capture utility ([netsh](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382\(v=ws.11\))) to investigate and troubleshoot potential network or Active Directory communication (ldap and kerberos) issue. For more information, see [Capture a Network Trace without installing anything](https://techcommunity.microsoft.com/t5/iis-support-blog/capture-a-network-trace-without-installing-anything-amp-capture/ba-p/376503). + +**VPC Flow logs**