deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #12005 from ChunlinXuMSFT/patch-1

Browse Source 
Update faq.yml to fix wrong information cloud trust compatibility with RODC
This commit is contained in:
Paolo Matarazzo 2025-02-12 08:08:34 -05:00 committed by GitHub
commit 7ab3b716c6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/identity-protection/hello-for-business/faq.yml
View File

@ -210,9 +210,9 @@ sections:
- question: Does Windows Hello for Business cloud Kerberos trust work in my on-premises environment? - question: Does Windows Hello for Business cloud Kerberos trust work in my on-premises environment?
answer: | answer: |
This feature doesn't work in a pure on-premises AD domain services environment. This feature doesn't work in a pure on-premises AD domain services environment.
- question: Does Windows Hello for Business cloud Kerberos trust work in a Windows sign-in with RODC present in the hybrid environment? - question: Does Windows Hello for Business cloud Kerberos trust work with RODC present in the hybrid environment?
answer: | answer: |
Windows Hello for Business cloud Kerberos trust looks for a writeable DC to exchange the partial TGT. As long as you have at least one writeable DC per site, login with cloud Kerberos trust will work. Windows Hello for Business cloud Kerberos trust functions correctly when the client authenticates directly to a writable domain controller or to a Read-Only Domain Controller (RODC) that doesn't cache the user's credentials, in accordance with the Password Replication Policy. If the client attempts to authenticate to an RODC that can cache the user's credentials, cloud Kerberos trust authentication might fail. To mitigate this, deploy KDC certificates to all RODCs to support Windows Hello for Business key trust authentication, which is also required for those RODCs to support LDAP over SSL. This configuration ensures that authentication can seamlessly failover to Windows Hello for Business key trust authentication, thereby guaranteeing successful user authentication.
- question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust? - question: Do I need line of sight to a domain controller to use Windows Hello for Business cloud Kerberos trust?
answer: | answer: |
Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when: Windows Hello for Business cloud Kerberos trust requires line of sight to a domain controller when: