{"id":1688,"date":"2022-11-30T12:00:00","date_gmt":"2022-11-30T12:00:00","guid":{"rendered":"http:\/\/neu.koetzingit.de\/stolpersteine-bei-dem-setup-der-nps-extension-fuer-microsoft-multi-faktor-authentication\/"},"modified":"2026-06-02T13:32:29","modified_gmt":"2026-06-02T13:32:29","slug":"stolpersteine-bei-dem-setup-der-nps-extension-fuer-microsoft-multi-faktor-authentication","status":"publish","type":"post","link":"https:\/\/www.koetzingit.de\/en\/stolpersteine-bei-dem-setup-der-nps-extension-fuer-microsoft-multi-faktor-authentication\/","title":{"rendered":"Common pitfalls when setting up the NPS extension for Microsoft Multi-Factor Authentication"},"content":{"rendered":"<p><span class=\"dropcapmiddle\">F<\/span>\u00fcr viele Kunden habe ich schon Microsoft MFA \u00fcber Citrix Netscaler verf\u00fcgbar gemacht und hatte dabei bereits diverse Probleme. Hier zusammengefasst, die <strong>Stolpersteine<\/strong> bei dem Setup der NPS-Extension f\u00fcr Azure AD Multi-Faktor-Authentifizierung (MFA). Ich hatte bei einem Kunden schon alle Probleme auf einmal.<\/p>\n<p><!--more--><\/p>\n<p>Microsoft Azure AD Multi-Faktor-Authentifizierung (MFA) ist eine sehr popul\u00e4re Option f\u00fcr Kunden eine flexible Zwei-Faktor-Authentifizierung einzusetzen, die dabei sehr benutzerfreundlich ist. Das Setup der NPS-Extension f\u00fcr MFA ist eigentlich problemlos, eigentlich! Hier eine Zusammenfassung der Probleme, die bisher aufgetreten sind.<\/p>\n<ul>\n<li>F\u00fcr die Kommunikation muss<strong> TLS1.2<\/strong> f\u00fcr Powershell aktiviert sein. Hierzu folgenden Befehl im Powershell als Administrator ausf\u00fchren:<br \/><strong><code>[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12<\/code>\n<p><\/strong><\/li>\n<li>Das Powershell-Skript <strong>AzureMfaNpsExtnConfigSetup.ps1<\/strong> hat hartkodiert <strong>$user=&#8217;NETWORK SERVICE<\/strong>&#8218;. Hiermit wird die Berechtigung auf den privaten Schl\u00fcssel des Zertifikats zur Kommunikation gesetzt.<br \/>Sind die Systeme aber z.B. in deutscher Sprache, dann sollte es <strong>Netzwerkdienst<\/strong> hei\u00dfen und muss daher im Skript anpasst werden!\n<\/li>\n<li>Selbst bei der Nutzung von Azure AD Free, muss beim Setup min. Azure AD Premium Trial aktiviert sein. <br \/>Hierzu einfach im Azure AD auf Lizenzen gehen und dann die Trial aktivieren, was nur wenige Sekunden dauert.\n<\/li>\n<li>Wer die NPS Rolle auf einem Server 2019 aktiviert, hat fehlerhafte lokale Firewall Regeln. <br \/>Diese m\u00fcssen gel\u00f6scht und wieder neu angelegt werden f\u00fcr UDP 1812\/1813\n<\/li>\n<li>Das Zertifikat f\u00fcr den Azure Multi-Faktor Auth Client muss alle zwei Jahre erneuert werden, lesen sie hierzu folgenden <a href=\"http:\/\/www.koetzingit.de\/ungueltiges-zertifikat-des-azure-multi-factor-auth-client\/\">Beitrag.<\/a>\n<\/li>\n<li>Soll die &#8222;GenehmigenVerweigern&#8220; Methode beibehalten werden, dann muss der Key <code>OVERRIDE_NUMBER_MATCHING_WITH_OTP<\/code> auf <code>FALSE<\/code> gesetzt werden.\n<\/li>\n<li>Wer NTLMv2 Authentifizierung einsetzt, muss MS-CHACP-V2nutzen und zudem den folgenden Registrierungswert setzen <br \/><code>HKLMSystemCurrentControlSetServicesRemoteAccessPolicy<\/code><br \/><code>\"Enable NTLMv2 Compatibility\" REG_DWORD = 0x00000001<\/code>\n<\/li>\n<\/ul>\n<p><strong>Sie kennen noch weitere Probleme bei der NPS-Extension Installation, dann lasst Sie es mich wissen.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>F\u00fcr viele Kunden habe ich schon Microsoft MFA \u00fcber Citrix Netscaler verf\u00fcgbar gemacht und hatte dabei bereits diverse Probleme. Hier [&hellip;]<\/p>\n","protected":false},"author":1755,"featured_media":1687,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[23],"tags":[301,303,300,299,291,298,302],"class_list":["post-1688","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-de","tag-extension","tag-fw","tag-mfa","tag-nps","tag-regeln","tag-rules","tag-tls"],"uagb_featured_image_src":{"full":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup.png",812,512,false],"thumbnail":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup-150x150.png",150,150,true],"medium":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup-300x189.png",300,189,true],"medium_large":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup-768x484.png",768,484,true],"large":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup.png",812,512,false],"1536x1536":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup.png",812,512,false],"2048x2048":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup.png",812,512,false],"trp-custom-language-flag":["https:\/\/www.koetzingit.de\/wp-content\/uploads\/2022\/11\/news-mfa-setup.png",18,12,false]},"uagb_author_info":{"display_name":"Thomas K\u00f6tzing","author_link":"https:\/\/www.koetzingit.de\/en\/author\/thomas-koetzing\/"},"uagb_comment_info":0,"uagb_excerpt":"F\u00fcr viele Kunden habe ich schon Microsoft MFA \u00fcber Citrix Netscaler verf\u00fcgbar gemacht und hatte dabei bereits diverse Probleme. Hier [&hellip;]","_links":{"self":[{"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/posts\/1688","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/users\/1755"}],"replies":[{"embeddable":true,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/comments?post=1688"}],"version-history":[{"count":1,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/posts\/1688\/revisions"}],"predecessor-version":[{"id":1819,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/posts\/1688\/revisions\/1819"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/media\/1687"}],"wp:attachment":[{"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/media?parent=1688"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/categories?post=1688"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.koetzingit.de\/en\/wp-json\/wp\/v2\/tags?post=1688"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}