Change to the Enforced by Default phase timeline for Kerberos signature validation risks

In response to a security risk in the Kerberos PAC Validation Protocol, Windows updates dated April 9, 2024, or later are being rolled out to add new behaviors to address the issue. To accomplish this, the deployment process is divided into three phases. The timeline for the second phase, which is the Enforced by Default phase, has been updated and will now begin in January 2025. During this phase, Windows domain controllers and clients will move to Enforced mode, aiming to enforce the new secure behavior by default, although the option to revert to Compatibility mode exists. Environments that are not up to date with the new update will not recognize the new request structure, which may result in security breaches. To prevent this, ensure you update your entire Windows environment, including the domain controllers and clients, and switch to Enforced mode. Further details can be found in KB5037754.

The post Change to the Enforced by Default phase timeline for Kerberos signature validation risks originally appeared on M365 Admin.