Blog Post

Ask the Directory Services Team
14 MIN READ

What happened to Kerberos Authentication after installing the November 2022/OOB updates?

DavidFisher's avatar
DavidFisher
Icon for Microsoft rankMicrosoft
Dec 13, 2022
Hello, Chris here from Directory Services support team with part 3 of the series.   With the November 2022 security update, some things were changed as to how the Kerberos Key Distribution Center...
Updated Jan 18, 2023
Version 6.0
Savannah_Greene's avatar
Savannah_Greene
Icon for Microsoft rankMicrosoft
Feb 18, 2023

KenFarrell 

The two registry settings you keep mentioning are for different Kerberos Security issues.

 

The ApplyDefaultDomainPolicy is for this Kerberos session key encryption type changes (CVE-2022-37966) that were released in November of 2022.  This update no longer works since the November Out Of Band Security Update.  So if your DC's have December or later security updates installed this is ignored.

 

The KrbtgtFullPacSignature is for a change being made to Kerberos Privilege Attribute Certificate (CVE-2022-37967) You really should not run this registry value at 0 tbh.  It should be set to 1 at a minimum or 2 and start looking for these audit events to catch what applications / servers are going to be an issue for you.

 

 

@Maxc0der88

RDP can use NTLM authentication.  NTLM would still work with 2003 however Kerberos authentication is the first authentication method used unless you reference the 2003 server by IP Address then NTLM will be used.