| MC894351 | (Updated) KB5014754: Certificate-based authentication changes on Windows domain controllers |
|---|
| Classification | stayInformed |
|---|---|
| Last Updated | 09/20/2024 18:15:24 |
| Start Time | 09/20/2024 18:15:23 |
| End Time | 09/20/2025 18:15:23 |
| Message Content |
On September 10, 2024, we updated article KB5014754 with changes that affect the timeline of security requirements for certificate-based authentication requests on Windows domain controllers.
After you install the Windows security updates released in February 2025 security update, authentication for certificates that do not meet the expected mapping requirements will be denied. This change is known as Full Enforcement mode. For full details, see KB5014754.
When will this happen:
In February 2025, or later, devices will move to Full Enforcement mode. However, you can move back to Compatibility mode until September 2025.
How this will affect your organization:
When you install the February 2025 security update, Windows updates, devices that are not already in Full Enforcement mode (StrongCertificateBindingEnforcement registry value is set to 2), will be moved to Full Enforcement mode. If authentication is denied, you will see Event ID 39 (or Event ID 41 for Windows Server 2008 R2 SP1 and Windows Server 2008 SP2). You will have the option to set the registry key value back to 1 (Compatibility mode) at this stage. In the September 2025 Windows update, the StrongCertificateBindingEnforcement registry value will no longer be supported.
What you need to do to prepare:
Review the date changes in the “Take action”, “Full Enforcement mode”, and “Registry key information” sections of KB5014754. Take the appropriate action needed to make your devices more secure.
Additional information:
For full detailed information, see KB5014754: Certificate-based authentication changes on Windows domain controllers.
|