KB5057784: Protections for CVE-2025-26647 (Kerberos Authentication)
The Windows security updates released on or after April 8, 2025, contain protections for a vulnerability with Kerberos authentication. To learn more about this vulnerability, please see CVE-2025-26647. When will this happen: April 8, 2025: Initial Deployment phase – Audit mode The initial deployment phase starts with the updates released on April 8, 2025. These updates add new behavior that detects the elevation of privilege vulnerability described in CVE-2025-26647 but does not enforce it. To enable the new behavior and be secure from the vulnerability, you must ensure all Windows domain controllers are updated and the AllowNtAuthPolicyBypass registry key setting is set to 2. July 8 2025: Enforced by Default phase Updates released on or after July 8, 2025, will enforce the NTAuth Store check by default. The AllowNtAuthPolicyBypass registry key setting will still allow customers to move back to Audit mode if needed. However, the ability to completely disable this security update will be removed. October 14, 2025: Enforcement mode Updates released on or after October 14, 2025, will discontinue Microsoft support for the AllowNtAuthPolicyBypass registry key. At this stage, all certificates must be issued by authorities that are a part of NTAuth store. How this will affect your organization: You are at risk when a certificate authority (CA) is part of the Windows root store but not the NTAuth store and a Subject Key Identifier (SKI) is present in a privileged account. To mitigate the risks, you must apply the protections described in CVE-2025-26647. What you need to do to prepare: UPDATE all domain controllers with a Windows update released on or after April 8, 2025. MONITOR new events that will be visible on domain controllers to identify affected certificate authorities. ENABLE Enforcement mode once your environment is no longer using certificates issued by authorities that are not in the NTAuth store. Additional information: KB5057784: Protections for CVE-2025-26647 (Kerberos Authentication) Message ID: MC1050816
The post KB5057784: Protections for CVE-2025-26647 (Kerberos Authentication) appeared first on M365 Admin.
Published on:
Learn moreWe can help you with KB5057784: Protections for CVE-2025-26647 (Kerberos Authentication)
If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.
Related posts
OneDrive: Respond to access requests directly in the Share dialog
Review and respond to access requests inside the Share dialog. When people request access to a file, folder, or library, anyone who can share ...
Dynamics 365 Business Central: Expense Agent – Log the expense in a case of lost receipt
Expense Agent helps employees keep expense submissions moving when an original receipt is unavailable. It guides employees through providing t...
Dynamics 365 Business Central: Expense Agent – Set expense spend limits in Expense Management
Take control of employee spending earlier in the expense process with configurable spend limits. Define thresholds that reflect your organizat...
Microsoft Viva: Engage – Improved shared messages end-user experience
Improving the shared conversation experience in Viva Engage to so it’s easier for users to discover, read, and participate. Product Micr...
Dynamics 365 Commerce: Design and print A4 and thermal receipts in a modern designer
Applies to: Point of Sale (Store Commerce app, Store Commerce for web), headquarters (Commerce headquarters receipt format designer), Hardware...
Dynamics 365 Business Central: Expense Agent – Split your expenses
Split a single expense across multiple allocations so costs are accurately assigned to the appropriate expense user, project, department, cust...
Dynamics 365 Customer Insights – Journeys: Marketing tools, skills and plugin are now available in Copilot Cowork
The Customer Insights plugin brings Dynamics 365 Customer Insights context, actions, and guided workflows to Copilot Cowork. Marketers and oth...
Dynamics 365 Business Central: Austria – Enable SAF-T audit file format
This feature extends support for the Standard Audit File for Tax (SAF-T) format to Austria, allowing customers in this coumtry to generate aud...
Dynamics 365 Business Central: France – Install French localization as an extension to the base app
The localized version for France is now available as a set of extensions on the W1 base app. This version includes a data upgrade feature to s...
Dynamics 365 Business Central: Norway – Install Norwegian localization as an extension to the base app
The localized version for Norway is now available as a set of extensions on the W1 base app. This version includes a data upgrade feature to s...