Blog Post

Ask the Directory Services Team
14 MIN READ

What happened to Kerberos Authentication after installing the November 2022/OOB updates?

DavidFisher's avatar
DavidFisher
Icon for Microsoft rankMicrosoft
Dec 13, 2022
Hello, Chris here from Directory Services support team with part 3 of the series.   With the November 2022 security update, some things were changed as to how the Kerberos Key Distribution Center...
Updated Jan 18, 2023
Version 6.0
KenFarrell's avatar
KenFarrell
Copper Contributor
Feb 16, 2023

Hi Savannah_Greene , Thank you very much for the reply.

 

2003

I think our concern here was around the workarounds we put in place to get 2003 working. krbFullPacSignature=0 will be changed to =1 on the 11th of April, but will the ability to ApplydefaultDomainPolicy=0 be removed prior to this date? Its only so I know at what cadence I need to decommission our 2003 estate.

 

2008 and 2008 R2

We have never had ESU. Our concern here is that we will not be able to decommission 2008 servers quickly enough to avoid issues. Our 2008 and 2008 R2 Servers are still accessible despite not having ESU and we are worried that this might change due to planned patches and KB5021131 has put the fear in us. Is there a point in time that we should be aware of that we should either have 2008 decommissioned or Migrated to Azure IaaS to take advantage of Extended ESU?

 

Many thanks for your time as I know you are very busy.