Windows Authentication Problems Seen After Applying Microsoft's May Patches -- Redmondmag.com

Windows Authentication Problems Seen After Applying Microsoft's May Patches

By Kurt Mackie
05/13/2022

Update 5/20: Microsoft now considers these authentication problems to be resolved, having released “out-of-band” updates on May 19, as described here.

Microsoft this week acknowledged possible authentication problems caused by its May security updates, which were released on Tuesday.

The authentication problems are just seen with Windows devices that are used as domain controllers and that received Microsoft's May 10-released updates. The issue stems from how certificates get mapped.

Here's Microsoft's terse explanation, which can be found in a tucked-away Windows 11 "Message Center" entry that's publicly available:

After installing updates released May 10, 2022 on your domain controllers, you might see authentication failures on the server or client for services such as Network Policy Server (NPS), Routing and Remote access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP). An issue has been found related to how the mapping of certificates to machine accounts is being handled by the domain controller.

Microsoft is still investigating the issue. A workaround, in the meantime, isn't rolling back the faulty May patches (which aren't identified). Microsoft instead wants affected organizations to "manually map certificates to a machine account in Active Directory" according to the instructions in this "Certificate Mapping" document.

There's an alternative approach if the manual mapping approach can't be carried out:

If the preferred mitigation will not work in your environment, please see KB5014754—Certificate-based authentication changes on Windows domain controllers for other possible mitigations in the SChannel registry key section. Note: Any other mitigation except the preferred mitigations might lower or disable security hardening.

The issue affects all supported Windows Server products, plus Windows Server 2008.

Signs early on that there was a problem with the May patches surfaced in this Reddit discussion thread for system administrators.

Also this week, Microsoft explained its security update validation process prior to patch releases, which gets carried out by Microsoft and its partners. It offered this explanation about its patch release processes:

Once our engineering teams develop an update, it must go through rigorous testing to better assure that the fix does not cause some unintended side effects. The fix must meet necessary quality standards before it can be released. Only after an update has passed these quality checks can it be released as part of our scheduled Update Tuesday process or for out-of-band release (outside of our normal update release process).

Microsoft has a rollback capability for patches that cause problems, when detected. However, organizations that applied Microsoft's May patches early on are out of luck, it seems.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.