Get-ADObject -Filter “msDS-supportedEncryptionTypes -bor 0x7 -and -not msDS-supportedEncryptionTypes -bor 0x18”Īnother step involves resetting the password of the KRBTGT account. To identify systems that might be impacted, run the following PowerShell script: They are also triggered if you have specifically set the encryption level on user accounts to DES/RC4 rather than AES.

Identifying impacted systemsĪfter installing the November security updates on your domain controllers, you may find that you suffer from authentication errors. I recommend taking all the steps detailed there. KB5021131 details how to manage the Kerberos protocol changes related to CVE-2022-37966. This blog post offers guidance on deploying the November 8 updates to address these Kerberos vulnerabilities and how to plan for the upcoming updates that complete the Kerberos hardening process. Accordingly, Microsoft is planning a series of security updates in the coming months that will help you secure Kerberos authentication without disrupting your business. Moreover, fully mitigating the vulnerabilities will break Kerberos authentication unless an organization takes steps to address the side effects. However, installing the November updates has caused authentication issues, user sign-in failure, the inability of users to access shared folders and other problems. Microsoft recommends installing these updates to all devices, including domain controllers, as described in KB5021131 and KB5020805.

Right now, that means paying attention to the Windows updates from November 8, 2022, which address critical Kerberos vulnerabilities ( CVE-2022-37966 and CVE-2022-37967) that could allow an attacker to elevate their privileges. Accordingly, IT pros need to stay on top of known exploits and mitigation measures that can reduce the risk of security breaches.

Indeed, because Kerberos controls access to so many IT environments around the world, adversaries are constantly looking for - and finding - ways to abuse it. While Kerberos is far more secure than the older NTLM protocol, it is not bulletproof. Kerberos has been the default authentication protocol in Active Directory (AD) environments since Windows Server 2000.

Kerberos windows