November 2022 Out of Band update released! Take action!

Greetings from the Windows Directory Services team!

The team wanted to bring to your attention the November 17th, 2022 release of an Out of Band (OOB), non-security update that addresses the Kerberos authentication issues experienced in some environments after installing November 8, 2022 (or later) updates on domain controllers.

After installing Windows Updates released on November 8, 2022 on Windows domain controllers, you might have issues with Kerberos authentication.

This specific failure is identified by the logging of Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 in the System event log of DC role computers with this unique signature in the event message text:

While processing an AS request for target service , the account did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : . The accounts available etypes : . Changing or resetting the password of will generate a proper key.

Where

(a.) “the missing key has an ID 1” and (b.) “4” is not listed in the “requested etypes” or “account available etypes” fields.

Some scenarios that might be affected:

Domain user sign in might fail. This also might affect Active Directory Federation Services (AD FS) authentication.

Group Managed Service Accounts (gMSA) used for services such as Internet Information Services (IIS Web Server) might fail to authenticate.

Remote Desktop connections using domain users might fail to connect.

You might be unable to access shared folders on workstations and file shares on servers.

Printing that requires domain user authentication might fail

For important details about how to obtain and install the November OOB update, please see the following link on Windows Release Health Message Center at:

Take action: OOB update to address an issue with sign in and Kerberos authentication

This article was originally published by Microsoft's Directory Services Team. You can find the original article here.

Tags: Active Directory, Authentication, How To

Related Posts