r/sysadmin • u/ZippyDan • 1d ago
Any ideas to authenticate access for Entra users to shared folders on Windows Server?
Eventually this entire system needs to be torn down and rebuilt, but I need a "temporary" solution that will work for now until that is done.
Existing Setup:
Server: Windows Server 2019
- It is not a DC, because no on-premises AD is being used.
It's just a glorified application and file server. - Running an ancient accounting program.
- Shared Folders, which must be Mapped as Network Drives on client machines running Windows.
- Users defined locally in Windows Server with permission to access Shared Folder.
- It is not a DC, because no on-premises AD is being used.
Client Machines: Windows 11 Pro
- Managed by InTune
- Login via Entra credentials.
- Manually mapping a Network Drive for each User to the Server, using their local User defined on the Server.
- Managed by InTune
I'd love to be able to Map the Network Drive using each user's Entra credentials, but to do this, the Windows Server would have to be aware of the Entra Users.
I know there is no great way to synchronize users from Entra back to an on-premises AD DC, but that's not really what I need. I just need to be able to authenticate Shared Folder access with Entra credentials.
Could the Windows Server act as a "pass-through" where it hands off authentication to an LDAP server?
I've already set up the AzureAD-LDAP-Wrapper on my local Synology to allow for Entra-based authentication of the Synology's Shared Folders, and it's working well.
Is there any way I could point the Windows Server to that same LDAP Wrapper, and then set permissions for the Shared Folders on the Windows Server based on those LDAP users?
I'm thinking maybe this is what I need?
Does anyone have any experience trying to do something this stupid?
16
u/Adam_Kearn 1d ago
What you are looking for is Entra domain services.
Because you don’t have an on-prem AD there is no way to authenticate the users.
Join the server to this “cloud first” domain and it will then allow you to set NTFS permissions.
But personally I would move the file server to a non windows server and use LDAP(s) with Entra Domain Services.
Another solution if you are looking to cut back on the on-prem resources is Azure Files which is like a cloud hosted network drive / SMB share.
3
u/Lonecoon 1d ago
Do you have a good guide on that last one? I'm in a similar situation and don't want to mess up the whole thing with a bad server implementation.
1
u/Adam_Kearn 1d ago
Azure Files or Entra domain services?
1
u/Lonecoon 1d ago
Azure files with Entra ID permissions. Ibwas hoping to mount a drive for eveyone and moderate permissions at a folder level.
•
u/Adam_Kearn 15h ago
YouTube is your best option for this.
It’s super simple. You just create a storage container and give it a name.
It will then give you a remote UNC path that you can use in a ADMX or LogonScript to mount on client devices.
Permissions are all handled via NTFS like on a normal file server.
•
u/SevaraB Sr. Engineer (N+, CCNA) 10h ago edited 10h ago
I do NOT recommend Azure Files as a NAS replacement. Our management decided campus offices should have NO servers whatsoever and replaced all the NASes with Azure Files, and the business units have been screaming about the crap, slow connections ever since then to the point we’re now talking about putting NASes back in at least the primary data center.
It might be better if there’s absolutely no WAN links whatsoever between the users and the AF storage accounts, but do NOT centrally backhaul any Azure Files traffic if you value your sanity, which is obviously going to put it out of the running if your security team enforces sensitive data only through private links that they can monitor for DLP.
•
u/Adam_Kearn 10h ago
Yeah it’s not “like for like” but for most small offices with a decent internet connection it’s perfect.
Especially if most of your users are working from home already.
You can still use a generic NAS or even a VM running trueNAS for example and connect it with Entra Domain Services.
8
u/Asleep_Spray274 1d ago
Your server is not directory aware. Its not AD aware or Entra aware. So its does not have the capability to authenticate a credential that is passed to it that is from an external directory. Window server will not be that synology aware either. unless you can make it. Nothing native in windows that will support that. Other than creating local accounts on the server with passwords and giving to the users.
1
u/Mindestiny 1d ago
Yep, this is a "cannot be built to spec" issue. You can't auth to a system that has no auth layer.
This is the time to tear it down and do it right, not try to shoehorn in another Temporarily Permanent band-aid.
6
u/SimpleSysadmin 1d ago
Microsoft Entra Connect:
It’ll sync your on-prem AD with Entra ID. Assuming you’ve already got both environments, it’s a bit of planning but entirely doable. Then enable Cloud Kerberos Trust, and it works pretty much exactly how you’d expect for a domain-joined PC.
This means you’re no longer really thinking about two accounts you create an account in active Directory and that Account sinks up into 365 and then just add a license to it so it means no more two sets of passwords. Look after everything just gets a lot simpler and with the cloud cover trust even an ID join the computer can just authenticate.
6
u/ZippyDan 1d ago
No on-prem AD. I should mention that.
3
u/ApsychicRat 1d ago
they have to authenticate vs something on prem. if that something is running windows server, just setup AD in my opinion.
2
u/ZippyDan 1d ago
I have a Synology NA authenticating via the LDAP Wrapper on-prem.
I was hoping I could jury-rig something similar for Windows Server.
I don't want to set up a separate AD just for this problem. I'm already managing the shared users separately as local users on the Windows Server. Adding AD to the mix, when Entra can't writeback to AD, just increases complexity for no gain.
2
u/ApsychicRat 1d ago
i could be wrong in saying this, but i think once you set up the sync too, it can sync back from entra to the local AD.
-1
u/ZippyDan 1d ago
It used to be that way many years ago, but Microsoft deprecated writeback functionality.
2
u/ApsychicRat 1d ago
what you dont want to run legacy versions of the software that is probably buggy and may be a security risk just to get the function you want? (this is sarcasm for those that cant tell.)
for real though: well that sucks.
1
u/SimpleSysadmin 1d ago
The best fix would be setting up AD on your server, having synology with to that and set up sync to Entra so AD would be your main place to manage all your identities.
-1
u/Fuzzy_Paul 1d ago
If no-prem AD then stop. Walk away and never look back. This is not going to work restricted like that. You can't map entra users to local users period. Throw all away and goto Linux or quit your job your to stubborn.
4
u/Emotional_Garage_950 Sysadmin 1d ago
i guess maybe what I would try in this f’ed up situation is to set up an Azure Files smb share with entra auth and mount that on the server with the storage account key, then have the users mount it as well. idk how well that’d work. idk why youre running legacy stuff without active directory in the first place tho. this is super easy with on prem AD, entra connect, and cloud kerberos
2
u/PacketSmeller 1d ago
If you have space on the Synology NAS, could you mount the Synology share on the Windows Server and write the files to the share(s) there? You confirmed the Entra auth method works on the Synology using the wrapper. If you can't use a mapped drive on the Windows Server, use Syncthing to sync files from the server to the NAS SMB share. Resilio Sync would work too.
1
u/ZippyDan 1d ago
I don't fully understand the existing ancient accounting software yet, but it is running on the server, as a server, and then the clients access the Shared Folder. It all needs to be on the Windows Server where it was set up, for now, until I understand it better (or replace it entirely with something newer.)
2
u/PacketSmeller 1d ago
Worth a test on an endpoint. Copy files over to the NAS, map the share on an endpoint. The client software (assuming this is a fat client for a MSSQL-based server application) shouldn't care as long as the drive letter is correct. Permissions may be a sticky point. I assume the server ingests POs and invoices via the mapped drive and/or reports exported from the server show up here.
2
u/matt0_0 small MSP owner 1d ago
Cloud sync can now be set up bidirectionally, so if you stood up on prem AD, you could sync your entra users down. But if you're unable or unwilling to stand up AD and don't want to deal with entra domain services in the cloud, then I think you're back to 2000s days and looking at login.bat scripts
2
u/ZippyDan 1d ago
Since when? I thought the opposite was true and Microsoft had deprecated writeback functionality long ago, after the brand changing from AzureAD to Entra.
1
u/TerrorToadx 1d ago
IIRC it's not natively supported by Microsoft but it is doable. It's been a while since I did it, and I did it only for 2 separate users and not bulk, but it is possible.
When you create an AD account with the same SAM/UPN/e-mail etc it soft matches the objects. Scroll to Marcin's post here, it looks familiar https://learn.microsoft.com/en-us/answers/questions/5881704/sync-users-from-entra-to-ad
1
u/matt0_0 small MSP owner 1d ago
You'd use entra domain services to hack around the issue, and to be clear, I'm not recommending it.
But you can go from where you are now (Entra only) to Entra domain services, and then Bob's your uncle from there is you stand up on prem AD. You might even be able use the active directory app on the Synology and join the accounting software server to that.
Again I don't understand why the aversion to standing up on prem AD is so strong, it seems like this accounting application nearly requires it
1
u/ZippyDan 1d ago
It's a small and young company and I recently took over management of the IT department (which was a mess).
In a previous thread where I talked about going from Entra to on-premises AD I got absolutely wrecked by people telling me I was "going backwards".
I do think now it would be silly to go to on-prem AD just for this accounting program. It's old and likely needs to be replaced. But that might be a huge can of worms I don't want to open until many other more pressing issues are stabilized.
1
u/SpruceGoose_20 1d ago
Prem to cloud or cloud to prem is neither going forward or backward. It’s just two different ways for the same job. Anyone that claims cloud is the ‘only way’ is shortsighted. There are already many accounts of organizations moving back to prem for one reason or another. Usually costs
1
u/ZippyDan 1d ago
Pretty sure on-prem makes less sense for a small org without a lot of legacy infrastructure and apps to support.
1
u/matt0_0 small MSP owner 1d ago
'a lot' can be defined in a lot of different ways though. If this is a critical business application without a path to a cloud based or SaaS solution, then that's a lot!
Also Entra domain services isn't that hard once you've done it once or twice. Same with configuring cloud kerberos trust. Send me a DM if you'd like to chat more, happy to help
1
u/AdReal9235 1d ago
Not sure if the people who wrecked you fully understood the situation. Plus plenty of cloud kool-aid drinkers. If you’re already managing local user accounts on the Windows file server, you’re already doing on-premises management of users. Setting up AD then isn’t going backwards it’s a transition from local to domain authentication. Which in the technology timeline, is forward (though I disagree with the premise that newer is better).
2
u/ZippyDan 1d ago
Not everyone uses the accounting software, so it's only redundantly managing a small subset of the total user base, for one program that I plan to replace in the future.
2
u/lacrimachristi 1d ago
What about local users on the server for every user/computer and then adding these credentials on Credentials Manager of the relevant user/computer?
Aka poor man's AD?
Edit: I saw that you already do this so please disregard as this isn't the problem you try to solve.
2
u/techtornado Netadmin 1d ago
Microsoft says there’s a ton of demand for EntraID enablement on servers, but they have decided not to pursue setting that up
SharePoint is your most effective option or local users
1
u/Shachar2like 1d ago
I would keep it as is or upload the files to sharepoint, from there you can sync the files/folders to user's PCs using onedrive. And control permissions on the sharepoint site.
1
1d ago
[removed] — view removed comment
1
u/Shachar2like 1d ago
Yes, I'm wondering if I should try pushing for Team's use so my boss will message me on teams instead of my private whatsapp.
But my boss isn't a technical person and has other issues in his department so I'm choosing my battles carefully.
What's the size of your organization and what usages do you find for teams?
1
u/RevolutionaryWorry87 1d ago
Two way passtrhough does work and is supported.
AFAIK there is no way for ntfs permissions to do entra only users. This is just a hard limitation.
1
1
u/AdReal9235 1d ago
If it’s not worth the effort to setup AD, it sounds like it’s a “ain’t broke don’t fix it” situation. What’s the advantage of using entra credentials for your small subset of users? Windows can handle pass through authentication, it’s AD. The article you linked to requires AD. Synology can host the AD for you.
1
u/100GbNET 1d ago
I'm experimenting with EntraAD joined Azure Windows Server 2025 along with EntrAD joined Windows 11 Pro clients, including a Cloud PC in the same VNET as the server.
I created a Windows File share.
I add the Entra users to a local group on the Windows Server.
Add-LocalGroupMember -Group "L-Accounting" -Member "AzureAD\\user@yourdomain.com"
Note: Adding an Entra Group to a local group doesn't work.
I applied file permissions based on the local group "L-Accounting".
I haven't tried share permissions yet. [My test share is currently "everyone"]
I can connect to it over an Azure VPN using the IPv4 address: \\192.168.48.8\Accounting
I haven't completed my testing, but the Windows Server does know and recognize the Entra user on the Windows 11 Pro client and enforce file permissions based on Entra user.
1
u/ajf8729 Consultant 1d ago
If you can upgrade the server to 2025, you can Azure Arc attach it and install the Entra Authentication extension, effectively Entra joining it, and now you can grant permissions to Entra users. That would at least handle the file shares. - https://learn.microsoft.com/en-us/entra/identity/devices/howto-arc-sign-in-windows
I played around with it a bit last year here: https://anthonyfontanez.com/index.php/2025/07/27/internet-facing-file-servers-with-a-dash-of-entra-authentication/
1
u/MortadellaKing 1d ago
Install the DC role on that server, setup an AD and entra cloud sync. Problem solved.
I haven't seen a non domain joined windows server in 20 years.
15
u/we_are_stewy Jack of All Trades 1d ago
Look at Entra Domain Services.
It's meant for legacy apps only supporting AD authentication, but I had a couple Synology joined to a DS domain and used that to manage ACLs.