New Microsoft emergency updates repair Home windows Server auth points

Microsoft has launched out-of-band updates to deal with authentication failures associated to Kerberos delegation situations impacting Area Controllers (DC) operating supported variations of Home windows Server.

On impacted programs, end-users can’t signal into providers or functions utilizing Single Signal-On (SSO) in Energetic Listing on-premises or hybrid Azure Energetic Listing environments.

These points have an effect on programs operating Home windows Server 2019 and decrease variations, together with Home windows Server 2016, Home windows Server 2012 R2, Home windows Server 2012, Home windows Server 2008 R2 SP1, and Home windows Server 2008 SP2.

The emergency updates tackle “a recognized subject which may trigger authentication failures associated to Kerberos tickets you acquired from Service for Consumer to Self (S4U2self),” a Microsoft announcement defined on Sunday.

“This subject happens after you put in the November 9, 2021 safety updates on area controllers (DC) which are operating Home windows Server.”

The entire checklist of out-of-band updates launched by Microsoft over the weekend contains:

How you can deploy the OOB updates

You won’t be able to put in these emergency updates by way of Home windows Replace, and they’re going to additionally not set up mechanically on affected DCs.

To obtain the standalone replace package deal, you’ll have to seek for them within the Microsoft Replace Catalog (it’s also possible to use the obtain hyperlinks out there above).

You may import this replace into Home windows Server Replace Providers (WSUS) manually utilizing the directions out there within the Microsoft Replace Catalog.

On Thursday, when Microsoft confirmed these points, the corporate mentioned that customers may see a number of of the next errors on impacted programs:

• Occasion Viewer may present Microsoft-Home windows-Kerberos-Key-Distribution-Heart occasion 18 logged within the System occasion log
• Error 0x8009030c with textual content Net Software Proxy encountered an sudden is logged within the Azure AD Software Proxy occasion log in Microsoft-AAD Software Proxy Connector occasion 12027
• Community traces include the next signature just like the next:
  • 7281 24:44 (644) 10.11.2.12 .contoso.com KerberosV5 KerberosV5:TGS Request Realm: CONTOSO.COM Sname: http/xxxxx-xxx.contoso.com
  • 7282 7290 (0) . CONTOSO.COM