Sign In Help
Schneider Electric
HelpSign In
Schneider Electric Exchange
  • Home
  • Collaborate
  • Develop
  • Shop
Home Collaborate Develop Shop Log in or Register Help

Invite a Co-worker

Send a co-worker an invite to the Exchange portal.Just enter their email address and we’ll connect them to register. After joining, they will belong to the same company.
You have entered an invalid email address. Please re-enter the email address.
This co-worker has already been invited to the Exchange portal. Please invite another co-worker.
Please enter email address
Send Invite Cancel

Invitation Sent

Your invitation was sent.Thanks for sharing Exchange with your co-worker.
Send New Invite Close
  • Home
  • Collaborate
  • Exchange Community
  • :
  • SCADA & Telemetry Solutions
  • :
  • Geo SCADA Expert Forum
  • :
  • Active Directory changes in March 2020
Community Menu
  • Forums
    • By Topic
        • EcoStruxure IT
          • EcoStruxure IT forum
        • Industrial Automation
          • Industry Automation and Control Forum
          • Alliance System Integrators Forum
          • Machine Solutions in the Digital Transformation
          • EcoStruxure Automation Expert / IEC 61499 Forum
          • Industrial Edge Computing Forum
          • Level and Pressure Instrumentation Forum
          • Modicon User Group
          • PLC Club Indonesia
          • SEE Automation Club Forum
          • Fabrika ve Makina Otomasyonu Çözümleri
          • Форум по промышленной автоматизации СНГ
        • SCADA & Telemetry Solutions
          • Geo SCADA Expert Forum
          • SCADA and Telemetry Devices Forum
        • Power Distribution IEC
          • Power Distribution and Digital
          • Power Standards & Regulations
          • Paneelbouw & Energie Distributie
        • Power Distribution Softwares
          • EcoStruxure Power Design Forum
          • SEE Electrical Building+ Forum
          • LayoutFAST User Group Forum
        • Solutions for your Business
          • Solutions for Food & Beverage Forum
          • Solutions for Healthcare Forum
    • By Segment
        • Food & Beverage
          • Solutions for Food & Beverage Forum
        • Healthcare
          • Solutions for Healthcare Forum
      • EcoStruxure IT
        • EcoStruxure IT forum
      • Industrial Automation
        • Industry Automation and Control Forum
        • Alliance System Integrators Forum
        • Machine Solutions in the Digital Transformation
        • EcoStruxure Automation Expert / IEC 61499 Forum
        • Industrial Edge Computing Forum
        • Level and Pressure Instrumentation Forum
        • Modicon User Group
        • PLC Club Indonesia
        • SEE Automation Club Forum
        • Fabrika ve Makina Otomasyonu Çözümleri
        • Форум по промышленной автоматизации СНГ
      • SCADA & Telemetry Solutions
        • Geo SCADA Expert Forum
        • SCADA and Telemetry Devices Forum
      • Power Distribution IEC
        • Power Distribution and Digital
        • Power Standards & Regulations
        • Paneelbouw & Energie Distributie
      • Power Distribution Softwares
        • EcoStruxure Power Design Forum
        • SEE Electrical Building+ Forum
        • LayoutFAST User Group Forum
      • Solutions for your Business
        • Solutions for Food & Beverage Forum
        • Solutions for Healthcare Forum
      • Food & Beverage
        • Solutions for Food & Beverage Forum
      • Healthcare
        • Solutions for Healthcare Forum
  • Blogs
    • By Topic
        • Industrial Automation
          • Industrial Edge Computing Blog
          • Industry 4.0 Blog
          • Industrie du Futur France
        • SCADA & Telemetry Solutions
          • SCADA and Telemetry Blog
        • Power Distribution IEC
          • Power Events & Webinars
          • Power Foundations Blog
        • Power Distribution NEMA
          • NEMA Power Foundations Blog
        • Power Distribution Softwares
          • EcoStruxure Power Design Blog
          • SEE Electrical Building+ Blog
        • Solutions for your Business
          • Solutions for Food & Beverage Blog
          • Solutions for Healthcare Blog
          • Solutions for Retail Blog
    • By Segment
        • Food & Beverage
          • Solutions for Food & Beverage Blog
        • Healthcare
          • Solutions for Healthcare Blog
        • Retail
          • Solutions for Retail Blog
      • Industrial Automation
        • Industrial Edge Computing Blog
        • Industry 4.0 Blog
        • Industrie du Futur France
      • SCADA & Telemetry Solutions
        • SCADA and Telemetry Blog
      • Power Distribution IEC
        • Power Events & Webinars
        • Power Foundations Blog
      • Power Distribution NEMA
        • NEMA Power Foundations Blog
      • Power Distribution Softwares
        • EcoStruxure Power Design Blog
        • SEE Electrical Building+ Blog
      • Solutions for your Business
        • Solutions for Food & Beverage Blog
        • Solutions for Healthcare Blog
        • Solutions for Retail Blog
      • Food & Beverage
        • Solutions for Food & Beverage Blog
      • Healthcare
        • Solutions for Healthcare Blog
      • Retail
        • Solutions for Retail Blog
  • Ideas
        • Industrial Automation
          • Modicon Ideas & new features
        • SCADA & Telemetry Solutions
          • Geo SCADA Expert Ideas
          • SCADA and Telemetry Devices Ideas
  • Knowledge Center
    • Building Automation Knowledge Base
    • Industrial Automation How-to videos
    • Ask Exchange
    • Digital E-books
    • Success Stories Corner
    • Power Talks
  • Events & Webinars
  • Support
    • User Guide
    • Leaderboard
    • Releases Notes
How can we help?
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
49234members
Join Now
242449posts
Join Now

Active Directory changes in March 2020

Options
  • Subscribe to RSS Feed
  • Mark Topic as New
  • Mark Topic as Read
  • Float this Topic for Current User
  • Bookmark
  • Subscribe
  • Mute
  • Printer Friendly Page
Solved Go to Solution
Back to Geo SCADA Expert Forum
Solved
AdamWoodland
Lt. Commander AdamWoodland Lt. Commander
Lt. Commander
‎2020-01-20 02:04 PM
3 Likes
6
2031
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-01-20 02:04 PM

Active Directory changes in March 2020

Hi ClearSCADA Administrators!

 

See https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirem...

 

Microsoft is fixing a bug in LDAP functionality in Active Directory to block insecure LDAP in March 2020. If you have your ClearSCADA set up to externally authenticate users using just "LDAP" against a domain controller, and not using "LDAP SSL", you may find after this update if applied your ClearSCADA users may not be able to log in. I have a ticket raised with support so someone can hopefully take a closer technical look at the possible impact to ClearSCADA.

 

I strongly recommend you review the Microsoft advisory on how to resolve the issue and refer to websites such as https://evotec.xyz/four-commands-to-help-you-track-down-insecure-ldap-bindings-before-march-2020/ to help identify which systems may have an issue (which I am yet to personally test those scripts, use at own risk).

 

 

Solved! Go to Solution.

Labels
  • SCADA
Share
Reply

Accepted Solutions
SGA_Mountford_D
Crewman SGA_Mountford_D
Crewman
‎2020-02-04 06:53 PM
0 Likes
3
1935
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 06:53 PM

Re: Active Directory changes in March 2020

Hi Adam,

 

Thanks for your post!

 

Was curious what we should actually be checking with our customer ClearSCADA systems?

 

Are servers using LogonUser for external authentication going to be affected?

 

Cheers!

See Answer In Context

Share
Reply
BevanWeiss
Admiral BevanWeiss
Admiral
‎2020-02-04 07:09 PM
1 Like
2
1932
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 07:09 PM

Re: Active Directory changes in March 2020

Hey Dave,

 

LogonUser and LDAPS/LDAP SSL won't be affected by this.

It will primarily affect systems which are authenticating against a 'remote' domain, one which the ClearSCADA / Geo SCADA Expert server may actually not be a member of.

 

However.... there have been a few clients that had issues in the early days with LogonUser around domain authentication timeouts.

I think maybe one in the west....  They may still be configured to use LDAP instead of LogonUser.

For almost all customers, it should be possible to just use LogonUser.

 

LDAPS/LDAP SSL is annoying, not just a tick box on Windows AD servers.

 

SI plan would be, for each customer server, check in Server Configuration if it's set to LDAP, if it is, then prepare a testing window to convert it across to LogonUser. Change Standby Server  LDAP->LogonUser, restart, and test a Windows Authentication logon to the Standby server (i.e. Client Connection settings set to prefer Standby).  If it all works, then perform the same on the current Main server.

 

If the system is configured to use LDAP against a remote domain.  Then the hoop jumping to get LDAPS will be required.

Here's a pretty good guide

https://gist.github.com/magnetikonline/0ccdabfec58eb1929c997d22e7341e45


Lead Control Systems Engineer for Alliance Automation (VIC).
All opinions are my own and do not represent the opinions or policies of my employer, or of my cat..

See Answer In Context

Share
Reply
SGA_Mountford_D
Crewman SGA_Mountford_D
Crewman
‎2020-02-04 07:17 PM
1 Like
1
1926
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 07:17 PM

Re: Active Directory changes in March 2020

Thanks Bevan; appreciate the speedy response!

See Answer In Context

Share
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
6 Replies 6
SGA_Mountford_D
Crewman SGA_Mountford_D
Crewman
‎2020-02-04 06:53 PM
0 Likes
3
1936
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 06:53 PM

Re: Active Directory changes in March 2020

Hi Adam,

 

Thanks for your post!

 

Was curious what we should actually be checking with our customer ClearSCADA systems?

 

Are servers using LogonUser for external authentication going to be affected?

 

Cheers!

See Answer In Context

Share
Reply
BevanWeiss
Admiral BevanWeiss
Admiral
‎2020-02-04 07:09 PM
1 Like
2
1933
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 07:09 PM

Re: Active Directory changes in March 2020

Hey Dave,

 

LogonUser and LDAPS/LDAP SSL won't be affected by this.

It will primarily affect systems which are authenticating against a 'remote' domain, one which the ClearSCADA / Geo SCADA Expert server may actually not be a member of.

 

However.... there have been a few clients that had issues in the early days with LogonUser around domain authentication timeouts.

I think maybe one in the west....  They may still be configured to use LDAP instead of LogonUser.

For almost all customers, it should be possible to just use LogonUser.

 

LDAPS/LDAP SSL is annoying, not just a tick box on Windows AD servers.

 

SI plan would be, for each customer server, check in Server Configuration if it's set to LDAP, if it is, then prepare a testing window to convert it across to LogonUser. Change Standby Server  LDAP->LogonUser, restart, and test a Windows Authentication logon to the Standby server (i.e. Client Connection settings set to prefer Standby).  If it all works, then perform the same on the current Main server.

 

If the system is configured to use LDAP against a remote domain.  Then the hoop jumping to get LDAPS will be required.

Here's a pretty good guide

https://gist.github.com/magnetikonline/0ccdabfec58eb1929c997d22e7341e45


Lead Control Systems Engineer for Alliance Automation (VIC).
All opinions are my own and do not represent the opinions or policies of my employer, or of my cat..

See Answer In Context

Share
Reply
SGA_Mountford_D
Crewman SGA_Mountford_D
Crewman
‎2020-02-04 07:17 PM
1 Like
1
1927
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 07:17 PM

Re: Active Directory changes in March 2020

Thanks Bevan; appreciate the speedy response!

See Answer In Context

Share
Reply
AdamWoodland
Lt. Commander AdamWoodland Lt. Commander
Lt. Commander
‎2020-02-04 07:43 PM
1 Like
0
1919
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-02-04 07:43 PM

Re: Active Directory changes in March 2020

Yeah, what Bevan said 🙂

 

Regarding validating ClearSCADA (and anything else on the system you may manage) I don't think you should be checking the product as such, you should be checking your domain logs to see what is triggering any entry. That last link has info on what logging you need to set (not enabled by default) and then what to parse in your domain logs to identify sources.

 

For example some network devices, PLCs and RTUs support LDAP authentication and may be affected if not using SSL/TLS.

 

The logging only appears every 24 hours so its a case of set it going and wait a day or two.

Share
Reply
Swindel
Swindel
Cadet
‎2020-08-22 06:06 AM
0 Likes
1
722
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-08-22 06:06 AM

Re: Active Directory changes in March 2020

In addition I can say that this type of protection through Active Directory can be further secured by using 2FA through universal protection tokens then adfs sso can be used very conveniently and simply and most importantly reliably. After all, the same Microsoft has support for azure adfs in providing security.

Tags (1)
  • Tags:
  • english
Share
Reply
BevanWeiss
Admiral BevanWeiss
Admiral
‎2020-08-22 11:11 PM
0 Likes
0
715
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Email to a Friend
  • Report Inappropriate Content
‎2020-08-22 11:11 PM

Re: Active Directory changes in March 2020

@Swindel The idea of MFA via the ADFS mechanism does sound good, although I've never tried this myself.

How does it interact with LDAPS?  Is it possible at all?

Or does it need to utilise the native LogonUser of a Domain Authenticated computer?

 

I've only seen the MFA utilised against a RADIUS configuration, and not LDAP/AD on its own, in this particular context.

I have seen custom GINA setups to enforce an MFA token entry for 'native' AD logon, but this is not something that GeoSCADA supports (since it doesn't support the GINA plugins for the second factor) [as far as I'm aware].


Lead Control Systems Engineer for Alliance Automation (VIC).
All opinions are my own and do not represent the opinions or policies of my employer, or of my cat..
Tags (1)
  • Tags:
  • english
Share
Reply
Top Experts
User Count
BevanWeiss
Admiral BevanWeiss
2
sbeadle
Sisko sbeadle Sisko
1
geoffpatton
Lieutenant geoffpatton
1
See More Top Experts
Find a Service Provider
Find a certified partner to help you address your integration, installation, maintenance and project needs.
View all Providers
Support

Have a question? Please contact us with details, and we will respond.

Contact Us
FAQ

Look through existing questions to find popular answers.

Learn More
About

Want to know more about Exchange and its possibilities?

Learn More

Full access is just steps away!

Join Exchange for FREE and get unlimited access to our global community of experts.

Connect with Peers & Experts

Discuss challenges in energy and automation with 30,000+ experts and peers.

Get Support in Our Knowledge Base

Find answers in 10,000+ support articles to help solve your product and business challenges.

Ask Questions. Give Solutions

Find peer based solutions to your questions. Provide answers for fellow community members!

Register today for FREE

Register Now

Already have an account?Log in

About Us FAQ Terms & Conditions Privacy Notice Change your cookie settings
©2020, Schneider Electric