PowerShell / PowerShell/Win32-OpenSSH

Cannot connect as "NT authority\system" account

Open
#2,048 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area-ssh Investigate Issue-Bug
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Steps to reproduce

I am using OpenSSH 8.6.0p1 on Windows 11 (client) and on Windows Server Essentials 2019 (server)
I can connect from client to server with any account except "NT authority\server"
Normal user accounts do work perfectly.
Open a powershell terminal as System account :

Start-Process -FilePath cmd.exe -Verb Runas -ArgumentList '/k C:\Local\Sysinternals\PsExec.exe -i -s powershell.exe'

(using psexec from SysInternals)
then try to connect to the server:

sftp 192.168.0.36
Expected behavior
The connection should be working. Or it should state that it is not possible to connect as SYSTEM.
Actual behavior
The connection is closed :

PS C:\WINDOWS\system32\config\systemprofile> sftp 192.168.0.36
Connection reset by 192.168.0.36 port 22
Connection closed


### Error details

```console
The log file for sshd reports:

8392 2023-04-11 00:06:19.468 debug3: checking match for 'Group Administrateurs' user système host 192.168.0.35 addr 192.168.0.35 laddr 192.168.0.36 lport 22
8392 2023-04-11 00:06:19.469 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'syst�me' Status: 0xC000006D SubStatus 0.
8392 2023-04-11 00:06:19.469 debug3: get_user_token - unable to generate token for user syst�me
8392 2023-04-11 00:06:24.216 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'syst�me' Status: 0xC000006D SubStatus 0.
8392 2023-04-11 00:06:24.216 error: get_user_token - unable to generate token on 2nd attempt for user syst�me
8392 2023-04-11 00:06:24.216 fatal: ga_init, unable to resolve user système
8392 2023-04-11 00:06:24.216 debug1: do_cleanup
8392 2023-04-11 00:06:24.216 debug1: Killing privsep child 1560
Environment data
Name                           Value
----                           -----
PSVersion                      5.1.22621.1037
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22621.1037
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
Version

8.6.0p1

Visuals

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Windows 11 to Windows Server 2019 connection as the SYSTEM account using the provided PsExec and sftp commands. Start with the sshd log entries for generate_s4u_user_token, get_user_token, and ga_init, then determine whether SYSTEM authentication should work or should fail with a clear error. Done means the behavior is corrected or the unsupported case is reported explicitly.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.