0

I am currently using Yubikey smartcards to authenticate users within a Domain (Domain B). Login and network shares are working perfectly.

However, when accessing Domain B's network share from another device on Domain (Domain A) using a smartcard to authenticate users, it does not work.

The event log in Windows Server for Domain B shows that the username and password from Domain A are supplied instead.

Example One - PC (Logged in as DomainB\User via Smartcard)

  • Connection to network share automatically completes

  • Access to \DomainB\NetworkShare works fine

Example Two - PC (Logged in as DomainA\User)

  • Connection to network share dialog asks for Smartcard

  • Access to \DomainB\NetworkShare fails

  • Upon inspection in DomainB event logs, username and password are DomainA\User

I'm aiming to be able to allow users connected to DomainA to insert their smartcards at the dialog prompt when connecting to the network share, enter their pin, then gain access to DomainB\NetworkShare. Logging in as DomainB\User rather than DomainA\User.

I have control over DomainB and not DomainA.

Improve this question
2
  • How is security set up on the share ... "Domain Users" or "Authenticated Users" because "Domain Users" will not work if DomainB event logs show you access from "DomainA\User".
    – toofat
    May 2, 2019 at 12:55
  • @toofat To test, I have set up two shares. One with 'Domain Users' access and another with 'Authenticated Users' access. When accessing either share, both present the File Explorer login dialog. Inserting the smartcard and entering the pin still fails. On Domain B's event log, the username is still being sent from DomainA, ie the logged in user. Rather than using the Smartcard details to login.
    – captbb
    May 2, 2019 at 16:00

1 Answer 1

Reset to default
0

I think the clue is in what you wrote here '..when accessing Domain B's network share from another device on Domain (Domain A)'

If you're logging into another device with traditional username/password and not the smart card, I'll assume that device hasn't been setup for smart card use. So when you try and connect to a network share on a device which isn't setup for smart card use, it fails.

This is most likely due to the absence of the Yubikey smart card minidriver on that device.

Just as you need the Yubikey smart card minidriver in order to successfully connect via RDP to a server for instance, you'll also need it on the device you're using on Domain A. Essentially, the minidriver is required on both the source and destination.

So, install the minidriver on your Domain A device then try again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .