Home configuration management mfa security sms

Boost Security: Secure SMS Provider Calls with MFA in Config Manager

Updated: • 0 • min read
Table of Contents

Boost Your Security: Locking Down SMS Provider Calls with MFA in Config Manager

Hey folks! Ever worry about unauthorized access to your Configuration Manager? Well, fret no more! Starting with version 1702, you can add an extra layer of security using Multi-Factor Authentication (MFA) for SMS Provider calls. Think of it as a double lock on your system’s front door, making it way harder for unwanted guests to sneak in. Let’s dive into how you can set this up and boost your peace of mind.

Boost Security
image just illustration

Understanding the Importance of MFA

Before we get into the how-to, let’s quickly cover why this is so important. The SMS Provider is a crucial part of Configuration Manager, handling all sorts of administrative tasks. Without proper security, a malicious actor could potentially gain access and wreak havoc. MFA adds that extra layer of protection, requiring users to verify their identity through multiple channels, like a password and a one-time code sent to their phone. This makes it significantly harder for unauthorized individuals to access your system, even if they somehow manage to steal a password.

Enabling MFA: A Step-by-Step Guide

Ready to lock things down? Here’s how to enable MFA for SMS Provider calls:

  1. Fire Up WBEMTEST: This tool lets you interact with the Configuration Manager’s inner workings.

  2. Connect to Your Namespace: Connect WBEMTEST to the primary site namespace: root\\sms\\site_<site code>. Then, select Execute Method.

  3. Specify the Object Path: In the Object Path field, enter sms_site, and click OK.

  4. Select the Method: From the Method list, choose SetAuthenticationLevel, then select Edit In Parameters.

  5. Configure Authentication Level and Exceptions: Here’s where the magic happens. You’ll see two key properties:

    • AuthenticationLevel: This determines the strength of MFA. Here’s a breakdown:

      • 0 (Default): No MFA required. Anyone with proper role-based access can make calls.
      • 10: Requires users to log in with a PIN or smart card and have the necessary permissions.
      • 20: Requires a PIN login, along with the necessary permissions.

    • ExceptionList: This allows you to bypass MFA for specific users or groups, like service accounts. You’ll need to add the UserSID or SecurityGroupSID to this list. Microsoft documentation provides more details on how to find these SIDs. Important note: Users in the exception list can’t modify the AuthenticationLevel.

    Once you’ve set these values, click Save Object. Remember, these are global settings, so they apply to all primary sites.

  6. Execute and Dismiss: Click Execute!, and then Dismiss. That’s it! You’ve just boosted your Configuration Manager security.

Verifying MFA is Enabled

Want to double-check everything is working? Run this SQL query:

select * from vSMS_SC_GlobalProperty where PropertyName='{3B1F3900-A186-11d0-BDA9-00A0C909FDD7} Authentication'

If MFA is enabled, the Value3 property will be 10.

PowerShell Power-Up: Streamlining MFA Configuration

For the scripting gurus out there, you can use PowerShell cmdlets to manage the AuthenticationLevel and ExceptionList.

Example 1: Setting the Authentication Level and Exceptions:

[array]$ExceptionList=@("S-1-5-<domain SID>-<RID of the user or group account>","S-1-5-<domain SID>-<RID of the user or group account>")
[uint32]$AuthenticationLevel=<Authentication level value>
Invoke-CimMethod -Namespace 'root\sms\site_<site code>' -ClassName 'SMS_Site' -MethodName 'SetAuthenticationLevel' -Arguments @{AuthenticationLevel=$AuthenticationLevel;ExceptionList=$ExceptionList}

Example 2: Restoring Default Settings:

[array]$ExceptionList=@() #empty array clears the exception list
[uint32]$AuthenticationLevel=0
Invoke-CimMethod -Namespace 'root\sms\site_<site code>' -ClassName 'SMS_Site' -MethodName 'SetAuthenticationLevel' -Arguments @{AuthenticationLevel=$AuthenticationLevel;ExceptionList=$ExceptionList}

Key Considerations

  • Full Administrator Privileges Required: You need to be a member of the Full Administrator role with access to the All scope to configure MFA.

  • Global Setting: You can enable MFA from any server hosting the SMS Provider since it’s a global setting.

Wrapping Up

So there you have it! A comprehensive guide to enabling MFA for SMS Provider calls in Configuration Manager. By taking these steps, you’re adding a robust layer of defense against unauthorized access, safeguarding your system and your data. Remember, security is a continuous process, not a one-time fix. Stay vigilant, stay informed, and stay secure!

Now it’s your turn! What are your thoughts on MFA? Have you implemented it in your environment? Share your experiences and questions in the comments below. We’d love to hear from you! And don’t forget to come back for more tips and tricks on keeping your systems safe and sound.

Post a Comment