Hope this post finds you in good health and spirit.
This post is regarding to addresses a security bypass vulnerability that affects the Kerberos Privilege Attribute Certificate (PAC) and allows potential attackers to impersonate domain controllers.
The improved authentication process in CVE-2021-42287 adds new information about the original requestor to the PACs of Kerberos Ticket-Granting Tickets (TGT). Later, when a Kerberos service ticket is generated for an account, the new authentication process will verify that the account that requested the TGT is the same account referenced in the service ticket.
After installing Windows updates dated November 9, 2021 or later, PACs will be added to the TGT of all domain accounts, even those that previously chose to decline PACs.
The initial deployment phase starts with the Windows update released on November 9, 2021.
This release: Adds protections against CVE-2021-42287
Adds support for the PacRequestorEnforcement registry value, which allows you to transition to the Enforcement phase early. Mitigation consists of the installation of Windows updates on all devices that host the domain controller role and read-only domain controllers (RODCs).
April 12, 2022: Second deployment phase
The second deployment phase starts with the Windows update released on April 12, 2022. This phase removes the PacRequestorEnforcement setting of 0. Setting PacRequestorEnforcement to 0 after this update is installed will have the same effect as setting PacRequestorEnforcement to 1. The domain controllers (DCs) will be in Deployment mode.
Note This phase is not necessary if PacRequestorEnforcement was never set to 0 in your environment. This phase helps ensure that customers that set PacRequestorEnforcement to 0move to setting 1 before the Enforcement phase.
Note This update assumes that all domain controllers are updated with the November 9, 2021 or later Windows update.
July 12, 2022: Enforcement phase
The July 12, 2022 release will transition all Active Directory domain controllers into the Enforcement phase. The Enforcement phase will also remove the PacRequestorEnforcement registry key completely. As a result, Windows domain controllers that have installed the July 12, 2022 update will no longer be compatible with:
- Domain controllers that did not install the November 9, 2021 or later updates.
- Domain controllers that installed the November 9, 2021 or later updates but have not yet installed the April 12, 2022 update ANDwho have a PacRequestorEnforcement registry value of 0.
- However, Windows domain controllers that have installed the July 12, 2022 update will remain compatible with:
- Windows domain controllers that have installed the July 12, 2022 or later updates
- Window domain controllers that have installed the November 9th, 2021 or later updates and have a PacRequestorEnforcement value or either 1 or 2.
Registry key information
After installing CVE-2021-42287 protections in Windows updates released between November 9, 2021 and June 14, 2022, the following registry key will be available:
1: Add the new PAC to users who authenticated using an Active Directory domain controller that has the November 9, 2021 or later updates installed. When authenticating, if the user has the new PAC, the PAC is validated. If the user does not have the new PAC, no further action is taken. Active Directory domain controllers in this mode are in the Deployment phase.
2: Add the new PAC to users who authenticated using an Active Directory domain controller that has the November 9, 2021 or later updates installed. When authenticating, if the user has the new PAC, the PAC is validated. If the user does not have the new PAC, the authentication is denied. Active Directory domain controllers in this mode are in the Enforcement phase.
0: Disables the registry key. Not recommended. Active Directory domain controllers in this mode are in the Disabled phase. This value will not exist after the April 12, 2022 or later updates.
Important Setting 0 is not compatible with setting 2. Intermittent failures might occur if both settings are used within a forest. If setting 0 is used, we recommend that you transition setting 0 (Disable) to setting 1 (Deployment) for at least a week before moving to setting 2 (Enforcement mode).
1 (when registry key is not set)
Is a restart required?
More info can be found here
So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!
Guys please don’t forget to like and share the post. You can also share the feedback on below windows techno email id.