{"id":16829,"date":"2020-11-19T23:36:41","date_gmt":"2020-11-19T22:36:41","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=16829"},"modified":"2022-11-03T10:36:53","modified_gmt":"2022-11-03T09:36:53","slug":"weitere-windows-updates-mit-fix-fr-kerberos-authentication-problem-19-11-2020","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/11\/19\/weitere-windows-updates-mit-fix-fr-kerberos-authentication-problem-19-11-2020\/","title":{"rendered":"Windows-Updates with Fix for Kerberos-Authentication-Problem (11\/19\/2020)"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/win102.jpg\" width=\"58\" align=\"left\" height=\"58\">[<a href=\"https:\/\/www.borncity.com\/blog\/2020\/11\/19\/weitere-windows-updates-mit-fix-fr-kerberos-authentication-problem-19-11-2020\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Microsoft has published further special updates for various Windows Server versions as of November 19, 2020. These are intended to fix the problems with Kerberos authentication of ticket renewals on domain controllers for the operating system versions concerned.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/vg07.met.vgwort.de\/na\/6664d8a00ce14ef2958c96ee3e143ed7\" width=\"1\" height=\"1\">In the articled <a href=\"https:\/\/borncity.com\/win\/2020\/11\/18\/windows-out-of-band-updates-with-fix-for-kerberos-authentication-ticket-renewal-issue\/\">Windows out-of-band updates with fix for Kerberos authentication ticket renewal issue<\/a> I already reported about the first unscheduled correction updates for the Kerberos authentication problem a few days ago. Blog reader EP has informed me now about further updates in <a href=\"https:\/\/borncity.com\/win\/2020\/11\/18\/windows-out-of-band-updates-with-fix-for-kerberos-authentication-ticket-renewal-issue\/#comment-12831\">this comment<\/a>. <\/p>\n<h2>List of out-of-band updates with Kerberos fixes<\/h2>\n<p>Microsoft&nbsp; had already released the following special updates for various Windows Server versions on November 17, 2020 (see <a href=\"https:\/\/borncity.com\/win\/2020\/11\/18\/windows-out-of-band-updates-with-fix-for-kerberos-authentication-ticket-renewal-issue\/\">Windows out-of-band updates with fix for Kerberos authentication ticket renewal issue<\/a>&nbsp; and <a href=\"https:\/\/borncity.com\/win\/2020\/11\/18\/windows-server-2012-r2-out-of-band-patch-for-kerberos-authentication-issue\/\">Windows Server 2012\/R2: Out-of-band patch for Kerberos authentication issue<\/a>).  <\/p>\n<ul>\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594442\/\">KB4594442<\/a> for Windows Server Version 1809 and Windows Server 2019\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594439\/\">KB4594439<\/a> for Windows Server 2012 R2\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594438\/\">KB4594438<\/a> for Windows Server 2012<\/li>\n<\/ul>\n<p>On November 19, 2020 the following updates for further Windows versions has been added.<\/p>\n<ul>\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594441\/\" target=\"_blank\" rel=\"noopener noreferrer\">KB4594441<\/a> for Windows Server Version 1607\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594443\/\" target=\"_blank\" rel=\"noopener noreferrer\">KB4594443<\/a> for Windows Server Version 1903\/1909\n<li><a href=\"https:\/\/support.microsoft.com\/help\/4594440\/\" target=\"_blank\" rel=\"noopener noreferrer\">KB4594440<\/a> for Windows Server Version v2004\/20H2<\/li>\n<\/ul>\n<p>The updates are available in the <a href=\"http:\/\/www.catalog.update.microsoft.com\/\">Microsoft Update Catalog<\/a> (search for the KB number). Microsoft recommends installing the last Servicing Stack Update (SSU) according to ADV990001, before installing the patch. According to the respective support articles, the special update should fix the following problems:&nbsp; <\/p>\n<ul>\n<li>Kerberos service tickets and ticket-granting tickets (TGT) might not renew for non-Windows Kerberos clients when PerformTicketSignature is set to <strong>1<\/strong> (the default).\n<li>Service for User (S4U) scenarios, such as scheduled tasks, clustering, and services for line-of-business applications, might fail for all clients when PerformTicketSignature is set to <strong>0<\/strong>.\n<li>S4UProxy delegation fails during ticket referral in cross-domain scenarios if DCs in intermediate domains are inconsistently updated and PerformTicketSignature is set to <strong>1<\/strong>.<\/li>\n<\/ul>\n<p>This should make all Windows servers available with updates to fix the Kerberos authentication problem. Regarding the problems with the installation of the software, please read the linked support articles.  <\/p>\n<h2>The Kerberos authentication problem<\/h2>\n<p>The November 2020 update <a href=\"https:\/\/support.microsoft.com\/help\/4586781\/\" target=\"_blank\" rel=\"noopener noreferrer\">KB4586781<\/a> for Windows Server, version 2004 and 20H2 fixes a number of issues (see also<a href=\"https:\/\/borncity.com\/win\/2020\/11\/11\/patchday-windows-10-updates-november-10-2020\/\">Patchday: Windows 10-Updates (November 10, 2020)<\/a>). However, in certain constellations, there were subsequently problems with Kerberos authentication on domain controllers if the update was installed on Windows Server, version 2004 and 20H2, but tickets were issued from Windows servers without this update. I had reported this in the blog post <a href=\"https:\/\/borncity.com\/win\/2020\/11\/16\/windows-10-windows-server-update-kb4586781-macht-probleme-mit-kerberos-dc-authentifizierung\/\">Windows 10\/Windows Server: Update KB4586781 causes issues with Kerberos DC authentication<\/a>. Microsoft had promised to fix it as soon as possible. With the above updates, these fixes should now be available.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Microsoft has published further special updates for various Windows Server versions as of November 19, 2020. These are intended to fix the problems with Kerberos authentication of ticket renewals on domain controllers for the operating system versions concerned.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,2],"tags":[195,159],"class_list":["post-16829","post","type-post","status-publish","format-standard","hentry","category-update","category-windows","tag-update","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=16829"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16829\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=16829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=16829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=16829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}