Microsoft’s Attempt To Harden Kerberos Broke It
Microsoft is rolling out fixes for problems with the Kerberos network authentication protocol on Windows Server after it was broken by November Patch Tuesday updates.
As we reported last week, updates released November 8 or later that were installed on Windows Server with the Domain Controller duties of managing network and identity security requests disrupted Kerberos authentication capabilities, ranging from failures in domain user sign-ins and Group Managed Service Accounts authentication to remote desktop connections not connecting.
There also were other issues including users being unable to access shared folders on workstations and printer connections that require domain user authentication failing.
“This issue might affect any Kerberos authentication in your environment,” Microsoft wrote in its Windows Health Dashboard at the time, adding that engineers were trying to resolve the problem.
Late last week, Microsoft issued emergency out-of-band (OOB) updates that can be installed in all Domain Controllers, saying that users don’t need to install other updates or make changes to other servers or client devices to resolve the issue. Also, any workarounds used to mitigate the problem are no longer needed and should be removed, the company wrote.
“You do not need to apply any previous update before installing these cumulative updates,” according to Microsoft. “If you have already installed updates released November 8, 2022, you do not need to uninstall the affected updates before installing any later updates including the [OOB] updates.”
Kerberos is used to authenticate service requests between multiple trusted hosts on an untrusted network such as the internet, using secret-key cryptography and a trusted third party to authenticate applications and user identities. It was created in the 1980s by researchers at MIT.
Microsoft began using Kerberos in Windows 2000 and it’s now the default authorization tool in the OS. Other versions of Kerberos – which is maintained by the Kerberos Consortium – are available for other operating systems including Apple OS, Linux, and Unix.
The vendor on November 8 issued two updates for hardening the security of Kerberos – as well as Netlogon, another authentication tool – in the wake of two vulnerabilities tracked as CVE-2022-37967 and CVE-2022-37966. Those updates led to the authentication issues that were addressed by the latest fixes.
Users of Windows systems with the bug at times were met with a “Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 error event” notice in the System section of the Event Log on their Domain Controller with text that included: “While processing an AS request for target service <service>, the account <account> did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1).”
For the standalone package of the OOB updates, users can search for the KB number in the Microsoft Update Catalog and manually import the fixes into Windows Server Update Services (see the instructions here) and Endpoint Configuration Manager (instructions here).
Microsoft has released cumulative updates to be installed on Domain Controllers: Windows Server 2022 (KB5021656), Windows Server 2019 (KB5021655), and Windows Server 2016 (KB5021654). ®
READ MORE HERE
