所以我们有这个旧的ASP网站(不会死)。

它当前位于win2k12上，并由spn和kerberos代理设置。它使用一个Com。对象，该对象运行一个.vbs，它与 Activity 目录进行了大量交谈。

我们将开始推出Windows 10实现。

在我们的开发环境中，它可以与win7/IE11和win10/IE11一起使用
在我们的生产环境中，win7/IE11已经起作用(并且仍然起作用)，但是win10/IE11却不起作用。

一些错误消息是

Active Directory error '80040e37'
The specified directory service attribute or value does not exist.

Error getting attribute max range
Attribute: [givenName]
Error description: [-2147463153] The attempted action violates the DS schema rules.

Dim oSysInfo 
 dim user
    'on error resume next 
    'Get the Current Users information.  This information is just the currently logged on user
'  Set oSysInfo = Server.CreateObject("ADSystemInfo")
  'Get Current User Object  
    sURL= "LDAP://AUsersDistinguishedName"
    response.write(sURL & "<br />")
on error resume next
    Set user = GetObject(sURL)

    pAttribute = "givenName"
    'response.write(user.get(pAttribute))

     Dim cl, sc, pr, pr2, pAttribute
     Set cl = GetObject(user.Schema)

    'Test(user)
         Set sc = GetObject(cl.Parent)     

       Set pr = sc.GetObject("Property", pAttribute)  

       response.write(pr.MaxRange)

       Set cl = Nothing
       Set sc = Nothing
       Set pr = Nothing 

  '-2147463155: Not found in directory cache, that means the MaxRange property is empty or not set, so there is no error
  if err.number <> 0 and err.number <> -2147463155 then 
     Response.Write "<br>Error description: [" & err.number & "] " & err.Description
  End If        

"Trust this computer for delegation to any service (Kerberos only)"

Cached Tickets: (4)

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x60a00000 -> forwardable forwarded renewable pre_authent 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x2 -> DELEGATION 
    Kdc Called: DomainControllerFqn

#1> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x1 -> PRIMARY 
    Kdc Called: DomainControllerFqn

#2> Client: MyUser @ DomainFqn
    Server: cifs/resourceServer @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a00000 -> forwardable renewable pre_authent 
    Start Time: 11/28/2017 10:27:11 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

#3> Client: admlareaua @ DomainFqn
    Server: HTTP/webserverFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 10:27:10 (local)
    End Time:   11/28/2017 20:27:10 (local)
    Renew Time: 12/5/2017 10:27:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 9:14:10 (local)
    End Time:   11/28/2017 19:14:10 (local)
    Renew Time: 12/5/2017 9:14:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0x1 -> PRIMARY 
    Kdc Called: DomainControllerFqn

#1> Client: admhqlareaua @ DomainFqn
    Server: HTTP/WebServerFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 9:14:10 (local)
    End Time:   11/28/2017 19:14:10 (local)
    Renew Time: 12/5/2017 9:14:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96
    Cache Flags: 0 
    Kdc Called: DomainControllerFqn

Cached Tickets: (3)

#0> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x60a00000 -> forwardable forwarded renewable pre_authent 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96


#1> Client: MyUser @ DomainFqn
    Server: krbtgt/DomainFqn @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96


#2> Client: MyUser @ DomainFqn
    Server: HTTP/WebServerFQN @ DomainFqn
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40a40000 -> forwardable renewable pre_authent ok_as_delegate 
    Start Time: 11/28/2017 9:17:24 (local)
    End Time:   11/28/2017 19:17:24 (local)
    Renew Time: 12/5/2017 9:17:24 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96

public JsonResult GetList2()
{
    var st = new List<string>();

    var currSchema = ActiveDirectorySchema.GetCurrentSchema();
    st.Add(currSchema.Name);

    foreach (ActiveDirectorySchemaProperty property in currSchema.FindAllProperties())
    {
        st.Add($"{property.Name} - {property.RangeUpper}");
    }

    return Json(st, JsonRequestBehavior.AllowGet);
}

Kerberos Considerations

When you enable Windows Defender Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. Use constrained or resource-based Kerberos delegation instead

最佳答案

因此，凭证保护似乎是罪魁祸首。我打开了另一个问题，尝试指出该问题-Switching application to use Constraint based kerberos

关于asp.net - ASP站点可与Win7 IE 11一起使用，但不能与Win10 IE11一起使用，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/46455799/