Windows Server

Microsoft Issues Emergency Update Fix for Windows Server SSO Authentication Bug

Microsoft Issues Update Fix for Windows Server SSO Auth Bug

Microsoft has issued an out-of-band emergency update fix to patch an authentication issue that was caused by the November 9th cumulative update for Windows Server. The bug affects Windows Server 2008 SP2 through to Windows Server 2019.

The November 9th Patch Tuesday cumulative update (CU) for Windows Server causes a problem that can cause authentication failures on Active Directory (AD) domain controllers (DC). Microsoft says about the new out-of-band update:

Addresses a known issue that might cause authentication failures related to Kerberos tickets you acquired from Service for User to Self (S4U2self). This issue occurs after you install the November 9, 2021 security updates on domain controllers (DC) that are running Windows Server.

The bug caused by the Patch Tuesday update can prevent end users from signing into services or apps that are configured to use single sign-on (SSO) in AD or hybrid Azure Active Directory (AAD) environments.

Sponsored Content

Passwords Haven’t Disappeared Yet

123456. Qwerty. Iloveyou. No, these are not exercises for people who are brand new to typing. Shockingly, they are among the most common passwords that end users choose in 2021. Research has found that the average business user must manually type out, or copy/paste, the credentials to 154 websites per month. We repeatedly got one question that surprised us: “Why would I ever trust a third party with control of my network?

Errors on systems impacted by the SSO Windows Server authentication bug

Microsoft says that organizations might see the following issues on systems affected by the bug:

  • Event Viewer might show Microsoft-Windows-Kerberos-Key-Distribution-Center Event 18 logged in the System event log
  • Error 0x8009030c with text Web Application Proxy encountered an unexpected is logged in the Azure AD Application Proxy event log in Microsoft-AAD Application Proxy Connector event 12027
  • Network traces contain the following signature similar to the following:
    • 7281 24:44 (644) KerberosV5 KerberosV5:TGS Request Realm: CONTOSO.COM Sname: http/
    • 7282 7290 (0) . CONTOSO.COM

Kerberos extension S4U2self impacted by November 2021 Patch Tuesday cumulative update

S4U2self is a Kerberos protocol extension for AD that lets a service get a Kerberos service ticket for itself on behalf of a user. Using S4U2self, the user is identified to the Key Distribution Center (KDC) with the user’s name and realm, or alternatively the user’s certificate.

Service for User (S4U) can be used in different scenarios, like running Windows Task Scheduler tasks under a user account without storing the user’s password. Or allowing an external web server to get a Kerberos service ticket on a user’s behalf.

Here is a list of the updates that you can download for each affected version of Windows Server:

Windows Server version Microsoft Update Catalog update link
Windows Server 2008 SP2 KB5008606
Windows Server 2008 R2 SP1 KB5008605
Windows Server 2012 KB5008604
Windows Server 2012 R2 KB5008603
Windows Server 2016 KB5008601
Windows Server 2019 KB5008602

How to install the S4U2self authentication fix for Windows Server domain controllers

Microsoft isn’t making this out-of-band fix available via Windows Update. But you can download the updates manually from the Microsoft Update Catalog using the links above and then manually important each update into Windows Server Update Services (WSUS).

Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (0)

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.
Live Webinar - Thursday, December 2nd! Active Directory Masterclass: AD Configuration Strategies for Stronger SecurityREGISTER NOW - Thursday, December 2, 2021 @ 1 pm ET

Active Directory (AD) is leveraged by over 90% of enterprises worldwide as the authentication and authorization hub of their IT infrastructure—but its inherent complexity leaves it prone to misconfigurations that can allow attackers to slip into your network and wreak havoc. 

Join this session with Microsoft MVP and MCT Sander Berkouwer, who will explore:

  • Whether you should upgrade your domain controllers to Windows Server
    2019 and beyond
  • Achieving mission impossible: updating DCs within 48 hours
  • How to disable legacy protocols and outdated compatibility options in
    Active Directory

Sponsored by: