Forum Discussion
2026-04 Update Breaks Domain Logins
I have an Active Directory domain that is old (from 2000!) that has been upgraded and moved to newer versions of Windows Server and Active Directory. I have domain controller VMs running Windows Server 2025 Standard Edition. Unfortunately they installed the latest 2026-04 patches which my have changed the Kerberos encryption from RC4 to AES. This has resulted in my not being able to log into any Active Directory domain accounts and the domain controllers themselves. I can only log into workstations using the local account.
Suffice to say this a nightmare. Any ideas how to fix it since I can't access the usual tools like Active Directory Users and Computers, Hyper-V won't connect to the VMs, etc. Thanks.
S
You will not have a change to access the domain controller, because there are no local users available.
The only possible solution I have found is:
- Restore domain controller from backup before install the update.
- Then reset the password of the administrator. This will force to generate an AES key.
- Install the update again.
Please have also a look on:
https://learn.microsoft.com/en-us/windows-server/security/kerberos/detect-remediate-rc4-kerberos
https://support.microsoft.com/en-us/topic/how-to-manage-kerberos-kdc-usage-of-rc4-for-service-account-ticket-issuance-changes-related-to-cve-2026-20833-1ebcda33-720a-4da8-93c1-b0496e1910dc
In my environment it has worked. Hope it works for you.
Good luck
9 Replies
- Use the physical or out of band console to sign in to the Hyper-V host with its local administrator account, open the VM console, boot one domain controller into Directory Services Restore Mode, and sign in with the DSRM administrator password.
- From an elevated command prompt, temporarily restore the pre-enforcement behavior, then restart normally:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" /v RC4DefaultDisablementPhase /t REG_DWORD /d 0 /f
shutdown /r /t 0
The April 2026 update changed the unspecified KDC default to AES only, and value 0 provides the documented manual rollback, with a restart required. This rollback is unavailable after the July 2026 updates.
Once one DC is operational, restore the remaining DCs, inspect KDC System events 201 through 209, reset passwords for affected old accounts so they receive AES keys, and explicitly configure AES support before removing the temporary rollback. Do not restore old DC snapshots or reset krbtgt as the initial recovery action.
Thomas--
Thanks, great minds think alike! Since my 2 DCs are also VMs, I shut them both down and restored a DC from backup that was dated before the 2026-04 patch. Once the restored DC was up and running, I enabled the AES encryption attributes on the userids (my AD dates from 2000 so the schema supported AES encryption but it was not enabled on any user accounts leading to my login issues). I also updated the ticketing service password twice (waiting over 10 hours in between) and modified the GPOs to force AES encryption.
Once I was able to access all my domain resources again, I realized I was going to experience USN issues since the 2 VM backups were over 6 hours apart by time stamp. (I have since addressed this issue by adjusting backup schedules so the 2 DCs will be backed up at the same time.) I restored the second DC VM, started it, logged in and immediately demoted it from being a DC.
Again I verified that everything inside the domain could be accessed. I removed DNS from the second DC, waited a few hours, and added back in DNS and AD DS. All seems to be good now! I just hope I am already prepared for the next Microsoft enforcement change coming in June 2026.
You will not have a change to access the domain controller, because there are no local users available.
The only possible solution I have found is:
- Restore domain controller from backup before install the update.
- Then reset the password of the administrator. This will force to generate an AES key.
- Install the update again.
Please have also a look on:
https://learn.microsoft.com/en-us/windows-server/security/kerberos/detect-remediate-rc4-kerberos
https://support.microsoft.com/en-us/topic/how-to-manage-kerberos-kdc-usage-of-rc4-for-service-account-ticket-issuance-changes-related-to-cve-2026-20833-1ebcda33-720a-4da8-93c1-b0496e1910dc
In my environment it has worked. Hope it works for you.
Good luck
For now, you can revert this behaviour from "enforcement mode" to "audit mode" by applying a registry setting to your domain controllers and restarting them. After installing the July 2026 updates you won't be able to roll back.
Here are some articles to read to understand the changes and what you can do about it.
What is going on with RC4 in Kerberos? | Microsoft Community Hub
https://support.microsoft.com/en-us/topic/how-to-manage-kerberos-kdc-usage-of-rc4-for-service-account-ticket-issuance-changes-related-to-cve-2026-20833-1ebcda33-720a-4da8-93c1-b0496e1910dc
Same here, 2 Domain Controllers with Server 2025 say wrong Password since Update 2026-04
Any idea how to fix this?I had one more Domain Controller on Server 2019. There I was able to login and to change the Domain Admin Password. Problem solved.
Maybe it would also bei possible to add a new Domain Controller with a older OS and to change the password there ...
Same, you can roll out with a backup. Restore your domain controller with a previous backup with your DSRM password. And you'll be fine.
Same as above : Restore your domain controller (where the PDC role is) and you'll be sorted.
Do not forget to retrieve the DRSM password .
Good luck .
