Blog Post

Ask the Directory Services Team
14 MIN READ

What happened to Kerberos Authentication after installing the November 2022/OOB updates?

DavidFisher's avatar
DavidFisher
Icon for Microsoft rankMicrosoft
Dec 13, 2022
Hello, Chris here from Directory Services support team with part 3 of the series.   With the November 2022 security update, some things were changed as to how the Kerberos Key Distribution Center...
Updated Jan 18, 2023
Version 6.0
Savannah_Greene's avatar
Savannah_Greene
Icon for Microsoft rankMicrosoft
Jan 07, 2023

Hey AussieCraig,

 

So the article you are referencing talks about November 8 security enables the settings to be configured, but the default is no change to original setting.  Next is once the December 13th security updates are installed, it is going to enable Auditing mode by default.  this means that if the registry setting is not configured then the default behavior is changed to AUDIT.

 

It would be best to make sure that your DC's have December 13th security updates installed on all of them, and then look for the auditing events, and address anything that is being shown.  If you are not seeing any audit events then you should be fine to either implement the setting in advance by configuring the KrbtgtFullPacSignature registry setting or wait for the enforcement phases.

 

In April you will NOT be able to set the value to 0, and July we set the default setting to be enforced, but you can put it back in audit mode to address anything having an issue.  After October you are going to be in enforcement mode with no ability to go back to audit mode as the KDC will basically start ignoring the KrbtgtFullPackSignature registry value after that time.