Microsoft has released emergency out-of-band (OOB) updates to address Active Directory (AD) authentication issues after installing Windows Updates issued during the May 2022 Patch Tuesday on domain controllers.
The company has been working on a fix for this known issue causing authentication failures for some Windows services since May 12.
“After installing updates released May 10, 2022 on your domain controllers, you might see authentication failures on the server or client for services such as Network Policy Server (NPS), Routing and Remote access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP),” Microsoft explained.
“An issue has been found related to how the mapping of certificates to machine accounts is being handled by the domain controller.”
The OOB Windows updates released today are available only via the Microsoft Update Catalog and will not be offered through Windows Update.
The company released the following cumulative updates for installation on Domain Controllers (no action needed on the client-side):
- Windows Server 2022: KB5015013
- Windows Server, version 20H2: KB5015020
- Windows Server 2019: KB5015018
- Windows Server 2016: KB5015019
Microsoft also released standalone updates:
- Windows Server 2012 R2: KB5014986
- Windows Server 2012: KB5014991
- Windows Server 2008 R2 SP1: KB5014987
- Windows Server 2008 SP2: KB5014990
These updates can be manually imported into Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager.
You can find WSUS instructions on the WSUS and the Catalog Site and Configuration Manager instructions on the Import updates from the Microsoft Update Catalog page.
“If you are using security only updates for these versions of Windows Server, you only need to install these updates for the month of May,” Microsoft added.
“If you are using Monthly Rollup updates, you will need to install both the standalone update listed above, and the Monthly rollups released May 10, 2022.”
Since this known issue was discovered, Cybersecurity and Infrastructure Security Agency (CISA) had to remove a Windows security flaw from its catalog of known exploited bugs (an actively abused Windows LSA spoofing zero-day tracked as CVE-2022-26925) due to the auth issues caused by May 2022 updates when deployed on domain controllers.
In November 2021, Microsoft released another round of out-of-band updates to address an issue causing Windows Server authentication failures related to Kerberos delegation scenarios impacting domain controllers.
