{"id":9884,"date":"2025-02-11T08:01:20","date_gmt":"2025-02-10T23:01:20","guid":{"rendered":"https:\/\/m365jp.net\/?p=9884"},"modified":"2025-02-11T08:04:08","modified_gmt":"2025-02-10T23:04:08","slug":"mc959496-full-enforcement-mode-for-certificate-based-authentication-on-windows-dcs-effective-february-2025","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2025-02-11-mc959496-full-enforcement-mode-for-certificate-based-authentication-on-windows-dcs-effective-february-2025","title":{"rendered":"MC959496 | Full Enforcement mode for certificate-based authentication on Windows DCs effective February 2025"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC959496 | Full Enforcement mode for certificate-based authentication on Windows DCs effective February 2025<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n
Classification<\/th>\nstayInformed<\/td>\n<\/tr>\n
Last Updated<\/th>\n02\/10\/2025 22:17:47<\/td>\n<\/tr>\n
Start Time<\/th>\n02\/10\/2025 22:17:45<\/td>\n<\/tr>\n
End Time<\/th>\n02\/10\/2026 22:17:45<\/td>\n<\/tr>\n
Message Content<\/th>\n\n
The last phase of the changes to certificate-based authentication on domain controllers (DC) is here. As stated in reminders, Full Enforcement mode phase starts in February 2025. This mode change occurs when you install the Windows updates dated February 2025 or later.<\/div>\n
<\/div>\n
Starting in May 2022, certificate-based authentication on Windows DCs started to go through a series of changes to enhance security, following a planned timeline of Enablement Phases.<\/div>\n
<\/div>\n
After you install the Windows security updates released in February 2025 or later, authentication for certificates that do not meet the expected mapping requirements will be denied. This change is known as Full Enforcement mode. However, you can move back to Compatibility <\/b>mode until September 2025. For full details, see KB5014754<\/a>.<\/div>\n
 <\/div>\n
When will this happen:<\/b><\/div>\n
<\/div>\n
In February 2025, devices will move to Full Enforcement mode.<\/div>\n
 <\/div>\n
How this will affect your organization:<\/b><\/div>\n
<\/div>\n
When you install the February 2025 or later Windows update, devices that are not already in Full Enforcement mode (StrongCertificateBindingEnforcement<\/b> registry value is set to 2) will be moved to Full Enforcement mode. If authentication is denied, you will see Event ID 39 (or Event ID 41 for Windows Server 2008 R2 SP1 and Windows Server 2008 SP2). You will have the option to set the registry key value back to 1 (Compatibility mode) at this stage. In the September 2025 Windows update, the StrongCertificateBindingEnforcement<\/b> registry value will no longer be supported.<\/div>\n
 <\/div>\n
What you need to do to prepare:<\/b><\/div>\n
<\/div>\n
Review the date changes in the \u201cTake action\u201d, \u201cFull Enforcement mode\u201d, and \u201cRegistry key information\u201d sections of KB5014754<\/a>. Take the appropriate action needed to make your devices more secure.<\/div>\n
 <\/div>\n
Additional information:<\/b><\/div>\n
<\/div>\n
For full detailed information, see KB5014754: Certificate-based authentication changes on Windows domain controllers<\/a>.<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

MC959496 | Full Enforcement mode for certificate-based authentication on Windows DCs effective February 2025 C […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9884","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/9884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=9884"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/9884\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=9884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=9884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=9884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}