Details
This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.
Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts.
The recommended state for this setting is: Enabled: Automatic.
Rationale:
Having stronger device authentication with the use of certificates is strongly encouraged over standard username and password authentication. Having this set to Automatic will allow certificate based authentication to be used whenever possible.
Impact:
None – this is the default behavior.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled: Automatic:
Computer ConfigurationPoliciesAdministrative TemplatesSystemKerberosSupport device authentication using certificate
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template Kerberos.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates (or newer).
Default Value:
Automatic. (Devices will attempt to authenticate using their certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted.)
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Windows.