Update November 15, 04:37 EST: Microsoft has released out-of-band updates to address the authentication issues on DCs running impacted Windows Server versions.
Microsoft says users might experience authentication issues on Domain Controllers (DC) running Windows Server. after installing security updates released during the November Patch Tuesday.
These authentication issues impact systems running Windows Server 2019 and lower versions with certain Kerberos delegation scenarios.
The list of affected platforms also includes Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2.
The authentication issues prevent end-users in Active Directory on-premises or hybrid Azure Active Directory environments from signing into services or applications using Single Sign-On (SSO).
"After installing the November security updates, [..] you might have authentication failures on servers relating to Kerberos Tickets acquired via S4u2self," Microsoft explains on the Windows health dashboard.
"The authentication failures are a result of Kerberos Tickets acquired via S4u2self and used as evidence tickets for protocol transition to delegate to backend services which fail signature validation."
The complete list of originating updates for this Windows Server known issue includes:
- KB5007206 - Windows Server 2019
- KB5007192 - Windows Server 2016
- KB5007247 - Windows Server 2012 R2
- KB5007260 - Windows Server 2012
- KB5007236 - Windows Server 2008 R2 SP1
- KB5007263 - Windows Server 2008 SP2
Microsoft said it's working on a resolution to address this Windows Server issue and estimates that it will provide a solution soon.
Kerberos authentication will fail on Kerberos delegation scenarios that rely on the front-end service to retrieve a Kerberos ticket on behalf of a user to access a backend service. Important Kerberos delegation scenarios where a Kerberos client provides the front-end service with an evidence ticket are not impacted. Pure Azure Active Directory environments are not impacted by this issue. - Microsoft
Impacted environments
According to Microsoft, affected environments might be using one of the following services or apps:
- Azure Active Directory (AAD) Application Proxy Integrated Windows Authentication (IWA) using Kerberos Constrained Delegation (KCD)
- Web Application Proxy (WAP) Integrated Windows Authentication (IWA) Single Sign On (SSO)
- Active Directory Federated Services (ADFS)
- Microsoft SQL Server
- Internet Information Services (IIS) using Integrated Windows Authentication (IWA)
- Intermediate devices including Load Balancers performing delegated authentication
Users might see one or more of the errors below on impacted systems:
- Event Viewer might show Microsoft-Windows-Kerberos-Key-Distribution-Center event 18 logged in the System event log
- Error 0x8009030c with text Web Application Proxy encountered an unexpected is logged in the Azure AD Application Proxy event log in Microsoft-AAD Application Proxy Connector event 12027
- Network traces contain the following signature similar to the following:
- 7281 24:44 (644) 10.11.2.12 .contoso.com KerberosV5 KerberosV5:TGS Request Realm: CONTOSO.COM Sname: http/xxxxx-xxx.contoso.com
- 7282 7290 (0) . CONTOSO.COM
Comments
arsalanbaig84 - 2 years ago
hello Sergiu,
did Microsoft provide any ETA when they will provide the new patch or provide the mitgation for this bug. i have notice when you apply the patches on DC it will cause the issue, normal server patches is not causing any issue. kindly can you pls update.
INTREPID-FL - 2 years ago
Microsoft marked this as resolved, BUT the out-of-band update KB5008602 that fixes the issue is only available for Server 2019. What about Server 2012 R2 and Server 2016?
Original issue improperly marked as "resolved": https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1809-and-windows-server-2019#2748msgdesc
Here is the out-of-band update KB5008602 (must be manually downloaded and installed): https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7
arsalanbaig84 - 2 years ago
KB5008601.KB5008602.KB5008603.KB5008604 all updates are avalaible you can take it from Microsoft catalog
INTREPID-FL - 2 years ago
Thanks.
kvarda - 2 years ago
There is Microsoft fix for Server 2016 as well. It is KB5008601: https://support.microsoft.com/en-us/topic/november-14-2021-kb5008601-os-build-14393-4771-out-of-band-c8cd33ce-3d40-4853-bee4-a7cc943582b9
ScootersComputer - 2 years ago
The articles are not clear on where the fix is to be installed. It clearly states that domain controllers with the November patches are the cause, but to resolve, is this additional KB5008602 installed on the domain controllers or on the servers/client systems experiencing the issue. We need a quick fix for an application pool experiencing the issue and applying to the application is much easier for us to get the change through quickly than hitting all our domain controllers.