> Source: [sk123840](https://support.checkpoint.com/results/sk/sk123840)

# sk123840 - Kerberos Authentication tickets are randomly generated for Machine name instead of User name 

| Property | Value |
|----------|-------|
| Solution ID | sk123840 |
| Date Created | 2018-04-30 |
| Last Modified | 2023-05-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Gaia |

## Symptoms

- * [Kerberos Authentication tickets](https://en.wikipedia.org/wiki/Kerberos_(protocol)) are randomly generated for Machine name instead of User name.
* By creating tasks list and scheduled tasks list in the relevant user machine from Windows Command Line:

  ```
  
  >tasklist /v > List_of_running_processes.txt
  >schtasks /Query /FO LIST /V > list_of_scheduled_processes.txt
  ```

  It was confirmed that no Web Browser application is running and generating Machine Name Kerberos tickets.
* Examining who generates the Machine Name Kerberos ticket to the transparent portal by the following steps:  
  1. Change the transparent portal debug level: Open `/opt/CPNacPortal/conf/httpd_nac_autoauth.conf` In the following line:  
     CustomLog /opt/CPNacPortal/logs/access_log common change "common" to "combined".  
     Note - "Common" -- shows all the requests received by transparent portal without information about the request generator  
     (User Agent sub-header is missing from the requests HTTP header) "Combined" -- The User Agent sub-header is printed from the request's HTTP header e.g. Firefox, IE etc.)
  2. Restart the transparent portal for changes to take affect: (might affect users for a split of second):

     ```
     
     #mpclient stop nac_transparent_auth
     #mpclient start nac_transparent_auth
     ```

  3. Identify wrong authentication by running the below command in the GW and search for Machine Authentication:

     ```
     
     # pdp monitor summary all flags ?rmcs
     ```

     <br />

     For example:

     ```
     
     10.188.69.1    f5f482cc  [u] $@CheckPoint.com       PCsGroup1  Kerberos         Fri Feb 23 09:24:40 2018
     ```

  4. Once a machine authentication found, find the relevant machine IP in the Access log:  

     ```
     #grep  /opt/CPNacPortal/logs/access_log
     ```

     <br />

     For example, in the lines below, we can see that the User Agent sub header contains "Microsoft-CryptoAPI/10.0"

     ```
     
     10.188.69.1 - - [23/Feb/2018:09:24:40 +0100] "GET /autoauth/AutoAuth?AgentCode=000&url=aHR0cDovL2N0bGRsLndpbmRvd3N1cGRhdGUuY29t
     L21zZG93bmxvYWQvdXBkYXRlL3YzL3N0YXRpYy90cnVzdGVkci9lbi9kaXNhbGxvd2VkY2VydHN0bC5jYWI/NTYzNzNmNDdlYTRmYWU4ZQ==&cti= HTTP/1.1" 401 
     348 "-" "Microsoft-CryptoAPI/10.0"
     
     10.188.69.1 - - [23/Feb/2018:09:24:40 +0100] "GET /autoauth/AutoAuth?AgentCode=000&url=aHR0cDovL2N0bGRsLndpbmRvd3N1cGRhdGUuY29t
     L21zZG93bmxvYWQvdXBkYXRlL3YzL3N0YXRpYy90cnVzdGVkci9lbi9kaXNhbGxvd2VkY2VydHN0bC5jYWI/NTYzNzNmNDdlYTRmY
     ```

## Cause

The above URL is generated by "automatic-updater-of-untrusted-certificates" Microsoft Windows Mechanism which utilizes the Windows Update Server (ctldl.windowsupdate.com).

More information about this behavior, can be found here - https://support.microsoft.com/en-us/help/2677070/an-automatic-updater-of-untrusted-certificates-is-available-for-window

**(!) Note -**In the tabled scenario"Automatic-updater-of-untrusted-certificates" was the trigger for generating the Kerberos Machine ticket Authentication, while it might be any other traffic that uses a Machine level priviliges ('System' user).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content