HOW TO - Use Yubikey To Secure Your Domain Network

Summary

Michael Trimblet of Loyal I.T. Solutions demonstrates how to configure a YubiKey for smart-card login to a Windows domain. The setup uses the YubiKey’s PIV (Personal Identity Verification) function to store a user certificate. Windows uses that certificate to verify identity, allowing enrolled users to sign in with the key and its PIN instead of a password.

Requirements and important cautions

• The demonstration uses a YubiKey 5-series key. The speaker says the domain server should run Windows Server 2012 R2 or later, and workstations should run Windows 8 or later.
• Install the YubiKey minidriver on each computer where the key will be used. For Remote Desktop, install it on both the client and destination computers.
• Certificate management is essential. The example root certificate lasts five years, while user certificates last one year and are set to renew six weeks before expiry. Devices must be on the network or connected through VPN to renew. Missed renewals can lock out a user, while an expired root certificate can affect the whole organization.
• Remote Desktop has additional configuration requirements, including disabling Network Level Authentication for the relevant connection. Hyper-V USB passthrough requires a Generation 2 guest with Enhanced Session Mode enabled.
• The presenter rates the setup five out of five “propeller hats” for difficulty and recommends involving IT professionals if administrators are unfamiliar with Active Directory or certificates.

Walkthrough: domain setup and login

1. Install and configure Active Directory Certificate Services as an enterprise root CA.
2. Create and link a Group Policy Object for YubiKey use, enabling ECC certificates for smart-card logon. The tutorial also shows how to define what happens when a key is removed: take no action, lock the workstation, log off, or disconnect a Remote Desktop session.
3. Duplicate the Smart Card Logon certificate template and configure compatibility, validity and renewal periods, certificate publication, request handling, cryptographic settings, and permissions for the intended users.
4. Issue the new template through the CA and enable certificate auto-enrollment policies for both computer and user configurations. Then update Group Policy.
5. On a workstation, start certificate enrollment through the notification icon or the certreq -enroll command, insert the key, and enter its PIN.
6. Test sign-in by choosing the smart-card option on the Windows login screen. To require the key for a particular user, enable “Smart card is required for interactive logon” in that user’s Active Directory account settings. The tutorial demonstrates that password sign-in is then rejected.

The video also tours YubiKey Manager’s PIV controls, including PIN and management-key settings, viewing certificates on the key, resetting PIV, and enabling or disabling USB and NFC interfaces.

Main speaker/source

• Michael Trimblet, “the Cyber Informer,” from Loyal I.T. Solutions.