Protections for CVE-2025-26647 (Kerberos Authentication) - Microsoft Support

Question

Microsoft please tell us what to do.

You don't tell us what you want. Why won't you just say what to do in the article you send to millions?

Protections for CVE-2025-26647 (Kerberos Authentication) - Microsoft Support

It makes no sense to tell us to do something but give no detail on what to do.

Answer 1

Hello,

Thank you for posting question on Microsoft Windows Forum!

Based on the information in your provided link Protections for CVE-2025-26647 (Kerberos Authentication) - Microsoft Support. It indicates that Microsoft added protections for a Kerberos elevation-of-privilege issue. The rollout into three phases, starts in Audit mode, then becomes enforced by default, and later removes the bypass.

Key dates you must plan around.

• April 8, 2025: Updates introduce Audit mode (no enforcement unless you explicitly enable it).
• July 8, 2025: Enforcement by default begins; you can still temporarily roll back to Audit via the registry setting.
• October 14, 2025: The bypass is removed; all logon certificates must be issued by CAs in the NTAuth store.
• If you need to change behavior before those phases, you must manually create the registry setting—it's not created automatically—and only do this on Windows KDCs (your DCs).

You can refer to the following articles for more information.

• https://m365admin.handsontek.net/kb5057784-protections-cve-2025-26647-kerberos-authentication/
• https://windowsforum.com/threads/critical-kerberos-authentication-breakage-in-windows-server-april-2025-updates-explained.365112/
• https://support.microsoft.com/en-us/topic/protections-for-cve-2025-26647-kerberos-authentication-5f5d753b-4023-4dd3-b7b7-c8b104933d53

Hope the above information is helpful!