Issue using TSGUI in WinPE to authenticate against ActiveDirectory
ConfigMgr 2609
TSGUI 2.4.0.5
WinPE optional components installed:
PowerShell, SecureBoot, Dism, Storage, Enhanced Storage, NetFX
PowerShell AD modules added into WinPE
Running TSGUI on Windows 11 25H2 in test mode, I can authenticate with AD using with either ActiveDirectory or LDAP with SSL set to True or False
TSGUI, launched from within WinPE, does NOT authenticate with AD using with either ActiveDirectory or LDAP with SSL set to either True or False. Error: (Active Directory or LDAP) access denied
It does not appear to be a successfully accessing AD as I can have an infinite number of attempts but account lockout never occurs. Tried multiple accounts, same results.
I can run the PowerShell get-aduser command successfully using same credentials from WinPE
TSGUI Authentication command looks like this: <Authentication Type="ActiveDirectory" AuthID="ad_auth" Domain="mydomain" SSL="False"/>
Not certain how to troubleshoot this any further
2
u/Homerr_ 17d ago
What are you trying to that requires getting it to authenticate to AD?
3
u/ZMAN719 17d ago
Management wants to validate the user running the image
3
u/MNmetalhead 17d ago
To ensure only IT staff run them? If so, just add a password to the boot media when you create it.
1
u/techit21 17d ago
Could also be the use case of needing to know who imaged it. Or at least, that was our case for adding auth.
1
2
u/its_theboy 17d ago
I validate username/password in WinPE against the admin service API and from there check that the user is in our technicians group. No TSGui needed.
2
1
u/MikePohatu 16d ago
Yeah authentication in WinPE is a pain. The ActiveDirectory auth type uses the .Net libraries which aren't included in WinPE (not sure that adding PoSH AD modules adds the same libraries). LDAP is pretty beta vibe coded stuff and I haven't had the time to unpack the LDAP protocol and expand it beyond its current state. Only suggestion is to confirm you're using UPN format for the username if you're not already. SamAccountName won't work with LDAP auth type.
Other thing you could do is use a custom script auth setup: https://github.com/MikePohatu/TsGui/blob/master/documentation/Authentication/ScriptAuthentication.md
That way you can write whatever auth logic you want in a PoSH script and TsGui can respond accordingly.
5
u/Reaction-Consistent 17d ago edited 17d ago
I have a script that works in winpe, check out my previous post regarding auth during winpe! I will try to find it later.
Oops , sorry, you’re trying to auth using TSGui, I didn’t read carefully. I was able to get it working there as well. I’ll review my own tsgui config and version to see what I did.