How to Configure MSAD DC Client Authentication to Connect to the Domain Controller via WMI (agentless)
As of firmware 10.5, it is possible to use agentless MSAD DC Client Authentication, which spares you from installing the Barracuda DC Agent on the Microsoft Active Directory server.
This option also uses the former dialog windows for configuration, however, it requires to use different parameters to be configured.
Before You Begin
As a prerequisite, a domain service account is required which must cover:
a membership in the Event Log Readers group on the DC.
WMI remote access to
Root\CIMV2.
Note that there are known limitations for using this option!
The new WMI-based mode reads login events from the domain controller's security event log. Authentications handled by a Windows Network Policy Server (NPS) — such as WiFi clients and mobile devices authenticating via RADIUS/802.1X — are logged by NPS separately and are currently not picked up by the DC Client. These users will not appear in the firewall's user database.
For environments relying heavily on NPS-authenticated devices, the current DC Agent mode may still be preferable for now.
Step 1. Configure Microsoft WMI
WMI stands for Windows Management Instrumentation and is Microsoft’s implementation of Web-Based Enterprise Management. In the context of MSAD DC Client Authentication, WMI can be used by the CloudGen firewall for connecting to the domain controller, which follows the idea of agentless authentication.
Because WMI is developed and maintained by Microsoft, it is necessary that you are familiar with this technology. As all software products undergo permanent changes in the course of time, Barracuda Networks recommends to stay in sync with the newest outcomes at the most authentic source.
For using WMI in this specific context, here are some sources for getting started with WMI:
Topic | URL |
|---|---|
Overview | https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page |
Connecting to WMI | |
Setting up a Remote WMI Connection | |
Securing a Remote WMI Connection | https://learn.microsoft.com/en-us/windows/win32/wmisdk/securing-a-remote-wmi-connection |
Step 2. How to Configure the MSAD DC Client on the CloudGen firewall for connecting via WMI
To configure MSAD DC Client settings on the Barracuda CloudGen Firewall for agentless MSAD DC Client Authentication, perform the following steps:
Go to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Authentication Service.
In the left menu, click MSAD DC Client.
The configuration view for MSAD DC Client Setting is displayed.
Click Lock.
Set Activate Scheme to Yes.
Set Enable DC Agent to Disabled.
(optional) Set Auto Logout After to the number of hours after which a user is automatically logged out. If the client receives the IP address via DHCP, sync this value with the DHCP lease timeout.
In the Server Setting table, add all Microsoft Active Directory servers supporting agentless configuration via WMI.
To add a server, click the green '+' symbol on top of the Server Setting list.
The Server Setting configuration window is displayed.
Enter the IP Address of the AD Server.
For the Username and Password, enter the credentials from the account for WMI authentication.
For Domain, enter the AD domain, e.g. mycorp.example.com
For Username format, select how users are identified on the firewall. One of the following options can apply:
Username
UPN
Email
(optional) Set the Sync Interval(s) value according to your requirements.
(optional) Depending on your requirements, set the User Info Helper Scheme to any necessary value, i.e. MSAD.
Finally, test your configuration. If you experience issues, re-check the WMI configuration if all necessary information has been provided for a complete WMI configuration. Consider that Microsoft maintains its own documentation, and missing information can sometimes be owed to relocations as a result of changes for WMI.