Complete Guide to Disallow Digest Authentication Using Intune

In this post, we will see and learn about the Disallow Digest Authentication Using Intune. We will apply Disallow Digest Authentication Policy Using Intune. We will make use of Configuration Profiles from Intune to implement this policy.

Disallow Digest Authentication Policy is a security configuration setting that can be enforced using Microsoft Intune, a cloud-based endpoint management solution. It helps protect your organization’s resources by preventing the use of Digest Authentication for accessing various services and applications.

Digest Authentication is a method used for authentication in web-based applications. It involves the exchange of a hashed password between the client and the server, which provides a level of security. However, Digest Authentication has certain vulnerabilities that make it less secure compared to other authentication methods like Kerberos or NTLM.

By enforcing the Disallow Digest Authentication policy using Intune, you can ensure that devices managed by Intune do not use Digest Authentication when accessing resources. This policy can be applied to various platforms, including Windows, macOS, iOS, and Android, allowing you to maintain a consistent security posture across different devices.

Patch My PC

Intune provides granular control over policy configuration. You can choose to apply the policy to specific platforms, device groups, or individual devices, allowing you to tailor the policy enforcement based on your organization’s requirements.

Windows CSP Details DisallowDigestAuthentication

We will see Windows CSP Details for this Policy setting DisallowDigestAuthentication. The Disallow Digest Authentication policy aims to improve the security posture of your organization by prohibiting the use of Digest Authentication. By doing so, it helps prevent potential security vulnerabilities associated with this authentication method.

The Disallow Digest Authentication policy can be applied to various platforms, including:

  • Windows: Devices running Windows 10 or later.
  • macOS: Mac computers running macOS.
  • iOS: iPhones and iPads running iOS.
  • Android: Android devices.

CSP URI – ./Device/Vendor/MSFT/Policy/Config/RemoteManagement/DisallowDigestAuthentication

Adaptiva
Complete Guide to Disallow Digest Authentication Using Intune Fig.1
Complete Guide to Disallow Digest Authentication Using Intune Fig.1

Disallow Digest Authentication Using Intune

To apply Disallow Digest Authentication Policy Using Intune, follow the steps stated below:

  • Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
  • Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, Select Windows 10 and later in Platform, and Select Profile Type as Settings catalog. Click on Create button.

PlatformProfile Type
Windows 10 and laterSettings Catalog
Table1 – Disallow Digest Authentication Policy Using Intune
Complete Guide to Disallow Digest Authentication Using Intune Fig. 2
Complete Guide to Disallow Digest Authentication Using Intune Fig. 2

On the Basics tab pane, provide a name for the policy as “Disallow Digest Authentication Policy.” Optionally, you can enter a description for the policy, and then proceed by selecting “Next.”

Complete Guide to Disallow Digest Authentication Using Intune Fig. 3
Complete Guide to Disallow Digest Authentication Using Intune Fig. 3

Now in Configuration settings, click Add Settings to browse or search the catalog for the settings you want to configure.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 4
Complete Guide to Disallow Digest Authentication Using Intune Fig. 4

In the Settings Picker windows, search by the keyword Digest Authentication, among two, you will see Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Client, and select this.

When you select the option as stated above, you will see only one setting, which is Disallow Digest authentication. After selecting your setting, click the cross mark at the right-hand corner, as shown below.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 5
Complete Guide to Disallow Digest Authentication Using Intune Fig. 5

Now, in the Administrative Templates, Enabled the Disallow Digest authentication, as shown below in the image.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 6
Complete Guide to Disallow Digest Authentication Using Intune Fig. 6

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 6
Complete Guide to Disallow Digest Authentication Using Intune Fig. 7

In the Review + Create tab, you need to review your settings. After clicking on Create, your changes are saved, and the profile is assigned.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 8
Complete Guide to Disallow Digest Authentication Using Intune Fig. 8

An automatic notification will be displayed in the top right-hand corner to indicate the successful creation of the “Disallow Digest Authentication Policy. Additionally, you can verify its presence by checking the Configuration Profiles list, where the policy will be clearly visible.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Disallow Digest Authentication Policy Using Intune

From Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To monitor the assignment of the policy, you must choose the appropriate policy from the list of Configuration Profiles. You can check the device and user check-in status to see if the policy has been successfully applied. If you wish to view more information, you can click on “View Report” to see additional details.

Complete Guide to Disallow Digest Authentication Using Intune Fig. 9
Complete Guide to Disallow Digest Authentication Using Intune Fig. 9

Intune MDM Event Log

To ascertain the successful application of String or integer policies on Windows 10 or 11 devices using Intune, event IDs 813 and 814 can be utilized. By analyzing these event IDs, you can identify both the policy’s application status and the specific value associated with the applied policy on those devices. For this specific policy, the value is a string and is associated with event ID 814.

To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.

MDM PolicyManager: Set policy string, Policy: (DisallowDigestAuthentication), Area: (RemoteManagement), EnrollmentID requesting merge: (4009A089-4FBA-482B-9D17-9E5A8428CB98), Current User: (Device), String: (<enabled />), Enrollment Type: (0xD), Scope: (0x0).

Complete Guide to Disallow Digest Authentication Using Intune Fig. 10
Complete Guide to Disallow Digest Authentication Using Intune Fig. 10

Upon examining the above-mentioned log in the Event Viewer, you will discover crucial details such as the Area and Enrollment ID. These pieces of information are instrumental in identifying the registry path. To find the relevant information, kindly refer to the table provided below:

AreaPolicyStringScopedEvent ID
RemoteManagementDisallowDigestAuthenticationEnabledDevice814
Table2 -Disallow Digest Authentication Policy Using Intune

The information provided in the above table for Disallow Digest Authentication Policy Using Intune can be utilized to access the registry settings storing group policy configurations on a target computer. By running “REGEDIT.exe” on the target computer, you can navigate to the specific registry path where these settings are stored.

  • Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\4009A089-4FBA-482B-9D17-9E5A8428CB98\default\Device\RemoteManagement

When you navigate to the above path in the Registry Editor, you will find the registry key with the name DisallowDigestAuthentication. Refer to the table and image below.

Registry NameValue
DisallowDigestAuthenticationEnabled
Table3 – Disallow Digest Authentication Policy Using Intune
Complete Guide to Disallow Digest Authentication Using Intune Fig. 11
Complete Guide to Disallow Digest Authentication Using Intune Fig. 11

Author

Abhinav Rana is working as an SCCM Admin. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.