Problem with Key Distribution Center (KDC) - krbtgt

Question

Hi Everyone,

I found Event ID 37 on DC. Is some problem in AD02 ?

The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket. This prevented security checks from running and could open security vulnerabilities. See https://go.microsoft.com/fwlink/?linkid=2173051 to learn more.

  Ticket PAC constructed by: AD02
  Client: domain.com\\user.name
  Ticket for: krbtgt

The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket. This prevented security checks from running and could open security vulnerabilities. See https://go.microsoft.com/fwlink/?linkid=2173051 to learn more.

  Ticket PAC constructed by: AD02
  Client: domain.com\\pc002$
  Ticket for: krbtgt

Please what to do.

I just do not know what's the fault?

Thanks in advance,

Will.

Answer 1

Patch all the domain controllers as first step. Then each user will get the new improved authentication information PACs of Kerberos Ticket-Granting Tickets. (TGT) described in the KB

Then it looks like you may get one warning for every user.

https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041

Adds the new PAC to users who authenticated using an Active Directory domain controller that has the November 9, 2021 or later updates installed. When authenticating, if the user has the new PAC, the PAC is validated.

the PacRequestorEnforcement registry value's only function is to allow you to transition to the Enforcement phase early. Otherwise not needed. (note: This value will not exist after the July 12, 2022 or later updates.)

--please don't forget to upvote and Accept as answer if the reply is helpful--