Loading...

Certificate-based authentication changes following installation of Windows updates released September 9, 2025

Certificate-based authentication changes following installation of Windows updates released September 9, 2025

Windows updates released September 9, 2025 and later, introduce security hardening changes to certificate mapping requirements in Windows Servers. The is the final milestone of a rollout that has gradually been taking place since 2023. IT administrators need to take action to ensure normal operations in accordance with the new certificate mapping criteria, and install the September 9, 2025 updates. For full details, see KB5014754: Certificate-based authentication changes on Windows domain controllers. When will this happen: This change is effective immediately in Windows updates released September 9, 2025. Servers which run Active Directory Certificate Services, as well as Windows domain controllers that service certificate-based authentication, are now required to meet certain certificate mapping criteria in order for authentication operations to succeed. These changes address vulnerabilities discussed in CVE-2022-34691 and others. How this will affect your organization: Vulnerabilities addressed in this scenario involve the use of dollar sign ($) at the end of a machine name, as well as conflicts between User Principal Names (UPN) and sAMAccountName. Both scenarios introduced vulnerabilities in the form of certificate emulation (spoofing). The September 2025 updates conclude the rollout of security requirements which prevent these vulnerabilities. If certificates cannot be strongly mapped per the security measures following installation of this update, certain authentication operations might be denied. What you need to do to prepare: The new certificate mapping requirements mentioned here have been rolling out with various degrees of enforcement throughout 2023 and 2024. Beginning with the September 9 updates, previous methods of grading enforcement across environments have been disabled. IT administrators need to confirm normal operations in accordance with the new certificate mapping criteria. As always, we recommend that you update your devices to the latest security update available to take advantage of the advanced protections from the latest security threats. Review the links provided in the Additional information section. Additional information: KB5014754: Certificate-based authentication changes on Windows domain controllers Message ID: MC1150557

The post Certificate-based authentication changes following installation of Windows updates released September 9, 2025 appeared first on M365 Admin.

Published on:

Learn more
Need help with this product?

We can help you with Certificate-based authentication changes following installation of Windows updates released September 9, 2025

If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.

M365 Admin
M365 Admin

by João Ferreira

Share post:

Related posts

Microsoft Teams: Updated header and dashboard for chats and channels on mobile

Microsoft Teams mobile will feature a redesigned header and lightweight dashboard for chats and channels, improving navigation and access to k...

10 hours ago

Deprecation for Manifest V2 (MV2) browser extensions support in Microsoft Edge

Microsoft Edge will retire Manifest V2 (MV2) extensions by early 2027, fully switching to Manifest V3 (MV3) for improved security and performa...

10 hours ago

Power BI subscriptions: Changes to notification delivery and sender experience

Power BI is updating subscription notification delivery to improve reliability and sender reputation, changing sender identity, email formatti...

10 hours ago

Cross-post SharePoint News to Engage

SharePoint News can now be cross-posted to Viva Engage communities with full fidelity and synchronized conversations across platforms. Rolling...

2 days ago

Call Quality Dashboard Custom Detailed Reports

Call Quality Dashboard will get a refreshed interface with enhanced accessibility and features like dark mode. Public preview starts mid-Augus...

2 days ago

Microsoft Copilot Pages: Access existing Pages from the “/” menu in chat

Starting late August 2026, users can access existing Pages via the “/” menu in Copilot chat, while the “Edit in Pages”...

2 days ago

Microsoft Teams: Collect information with List Form in Workflows

Microsoft Teams Workflows will add a new trigger, “A form is submitted,” for automating actions based on SharePoint list–backed fo...

2 days ago

Microsoft Viva Engage: Reducing reply notification volume in email

Microsoft Viva Engage will reduce email reply notifications by only sending alerts for direct replies, @mentions, and new posts, cutting down ...

2 days ago

Microsoft Teams: Lobby visibility will align with the “Who can admit from lobby” meeting option

Microsoft Teams will align lobby visibility with the “Who can admit from lobby” setting, so only users allowed to admit participan...

2 days ago

Microsoft Word: Similarity Checker retirement

Microsoft Word’s Similarity Checker will be retired on October 3, 2026, and removed from Microsoft Editor. Other writing and editing fea...

2 days ago

Newsletter

Get the latest Dynamics 365 and Power Platform content in your inbox

A curated digest of community blogs, product news, videos, and podcasts — delivered without the noise.

Weekly updates Unsubscribe anytime Fresh community picks
We use your email only for the newsletter and you can unsubscribe at any time.
By subscribing, you agree to the privacy policy.