Temporarily allow Kerberos authentication to Windows 2003 boxes after applying November 2022 updates

Question

Please let's skip the part "what? 2003???" etc :P That's nothing into production, but I need to be able to allow communication with them for some more week if possibile.

As you know (and if I correctly understood), November updates, I think the kb5021131 in particular for this issue, set the default enc type to AES for Kerberos authentication, if not else specified for the specific account.

I traced the traffic between my Win 10 box and the Windows 2003, and I see the following (as you see etype is AES256 and 2003 does not support that):

Then, it follows the error:

My question is:

How can I define that just for that computer account the Enc type must be RC4? Is that possible? I was looking for the "msDS-SupportedEncryptionTypes" attribute for the computer object in AD, but it has been added starting from Windows 2008. Thank you.

Answer 1

The registry setting described here may help.

https://support.microsoft.com/en-us/topic/kb5021130-how-to-manage-the-netlogon-protocol-changes-related-to-cve-2022-38023-46ea3067-3989-4d40-963c-680fd9e8ee25
https://support.microsoft.com/en-us/topic/kb5020805-how-to-manage-kerberos-protocol-changes-related-to-cve-2022-37967-997e9acc-67c5-48e1-8d0d-190269bf4efb
https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

You may need to upgrade the operating system to something supported.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Read on here.
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

The settings here are all there is to work with regarding KB5021131
https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

Did you successfully figure out how to authenticate your 2003 servers?
We have two 2003 servers in our environment that cannot be upgraded any time soon as they run essential software that isn't compatible with newer operating systems. Each time we have attempted to update our domain controllers since the November 2022 update, we lose connection to the 2003 servers and need to revert the domain controllers.