Blog Post

Ask the Directory Services Team
2 MIN READ

November 2022 Out of Band update released! Take action!

JR_Nieves's avatar
JR_Nieves
Icon for Microsoft rankMicrosoft
Nov 18, 2022
Greetings from the Windows Directory Services team! The team wanted to bring to your attention the November 17th, 2022 release of an Out of Band (OOB), non-security update that addresses the Kerbe...
Published Nov 18, 2022
Version 1.0
Finalnet's avatar
Finalnet
Copper Contributor
Nov 21, 2022

Please have a look on this KB: https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

It disables DES / RC4 for my understanding.

 

I found the following table very helpful (Not my page, use at own risk):

https://dirteam.com/sander/2022/11/11/knowledgebase-you-experience-errors-with-event-id-14-and-source-kerberos-key-distribution-center-on-domain-controllers/

AS KB5021131 deactiviated the first 3 colums, all configuration with green in the first 3 columns should/would break for my understanding.

 

I'm not 100% sure. Microsoft should clarify or deny: That if the Policy on DC Level is set to deny lower encryption methods, the user setttings shouldn't have any impact.

PS: All DCs should all have the updates.