Blog Post

Ask the Directory Services Team
2 MIN READ

November 2022 Out of Band update released! Take action!

JR_Nieves's avatar
JR_Nieves
Icon for Microsoft rankMicrosoft
Nov 18, 2022

Greetings from the Windows Directory Services team!

The team wanted to bring to your attention the November 17th, 2022 release of an Out of Band (OOB), non-security update that addresses the Kerberos authentication issues experienced in some environments after installing November 8, 2022 (or later) updates on domain controllers.

 

After installing Windows Updates released on November 8, 2022 on Windows domain controllers, you might have issues with Kerberos authentication.

This specific failure is identified by the logging of Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 in the System event log of DC role computers with this unique signature in the event message text:

 

While processing an AS request for target service <service>, the account <account name> did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : <etype numbers >. The accounts available etypes : <etype numbers>. Changing or resetting the password of <account name> will generate a proper key.


Where

  • (a.) “the missing key has an ID 1” and (b.) "4" is not listed in the "requested etypes" or "account available etypes" fields.

Some scenarios that might be affected:

For important details about how to obtain and install the November OOB update, please see the following link on Windows Release Health Message Center at:
Published Nov 18, 2022
Version 1.0

26 Comments

  • jt8585's avatar
    jt8585
    Brass Contributor
    Apr 17, 2023

    If we didn't install 11/2022 patch and installed 3/2023, is this OOB still needed?

     

    Once OOB is isntalled, does it automatically add the required registry key on DCs? or nothing needs to be done?

  • swisslegit90's avatar
    swisslegit90
    Copper Contributor
    Jan 30, 2023

    I am confused, i am getting 44 Events, but just from domain controllers, so host and Computer Attribute in the Event is a Domain Controller.

     

    Can I assume that i just move to enforcement mode and all will work, cause dc's are adding full pac signature (all Domain Controllers are patched with the december and january updates)

     

     

    Example Event:

    host 

    dc1

    sourcetype 

    windows_syslog 

    Computer 

    dc1.domain.ch

    EventChannel 

    System 

    EventDescription 

    Key Distribution Center (KDC) encountered a ticket that did not contain the full PAC Signature 

    EventID 

    44 

    EventLevel 

    3 

    EventProvider 

    Microsoft-Windows-Kerberos-Key-Distribution-Center 

  • BishopstonIT's avatar
    BishopstonIT
    Brass Contributor
    Dec 19, 2022

    does this OOB update still need installing, or is it included within the December updates?

  • danielkaliel's avatar
    danielkaliel
    Copper Contributor
    Nov 29, 2022

    Kerberos in Chrome has stopped working since this update and the OOB install.  I have ensured that msDS-SupportedEncryptionTypes is cleared for all users.  The reg key has been set to enable auditing on the domain controllers.  Anyone else experiencing this?

  • Alban1998's avatar
    Alban1998
    Iron Contributor
    Nov 25, 2022

    Of course they should provide a fix for high CPU usage, I'm just pointing it's an issue on Windows Server 2016, not something affecting all Windows Server OS (at least that's what it seems).

  • RR13's avatar
    RR13
    Copper Contributor
    Nov 25, 2022

    Alban1998 A missconfiguration of what exactly ? When you have all your gMSA accounts for example configured with only AES128/256 encryption type and the KB / out-of-band caused authentication failures, I don’t think it’s a missconfiguration.. Same for LSASS, Windows Server 2016 is still supported by MS and a stable OS so if the KB causes some high CPU usage, Microsoft has to provide a fix. 

  • Alban1998's avatar
    Alban1998
    Iron Contributor
    Nov 25, 2022

    RR13 This is about your high CPU usage. It seems to impact only WS 2016 machines so far.

    And you cannot ask a KB to fix misconfigurations and faulty apps.
    We could ask for a better QA with such hotfix but that's a thing of the past.

  • RR13's avatar
    RR13
    Copper Contributor
    Nov 25, 2022

    Alban1998 all the DC are running under Windows Server 2016. It’s not a fix for me to change the encryption type used by the service account or something else. The KB and the Out-of-Band should be fix to avoid this kind of errors ! It’s my opinion 🙂