This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 90%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
After installing November 2021 MS security updates on DC (OS 2016) + installing emergency patch KB5008601 we see a lot Events ID 37:
Event ID 37
The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket. This prevented security checks from running and could open security vulnerabilities. See https://go.microsoft.com/fwlink/?linkid=2173051 to learn more.
Ticket PAC constructed by: DC2
Client: DOMAIN\RANDOMSERVER$
Ticket for: krbtgt
How to solve this?
Hi @BCR ,
There's a KB article for this over here:
KB5008380—Authentication updates (CVE-2021-42287)
https://support.microsoft.com/en-gb/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
You will need to perform the actions mentioned in the KB article to stop the events.
----------
If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!
Best regards,
Leon
Hi.
Thank you for your reply.
I have already came accross on that article today.
We had installed November 2021 updates on DC (WIN 2016) + emergency patch.
Article is mentioning (correct me if I'm wrong), that we should see a new registry key:
"PacRequestorEnforcement"
inside
"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Kdc"
We had checked the patched DC and it does not contain that key (after pushing NOV21 updates + emergency patch + reboot).
We have also checked other DC's (WIN 2016) which weren't patched yet, and they also do not have that registry key.
No, it will not add a new registry key, this will be done in future patches released in the year 2022, it simply adds support for the registry key, which you will now have to manually create if you want to mitigate this right now.
Thank you for your reply!
Sorry if this question may sound dumb, but can Event 37 be currently treated as "soft alarm" or can it be "ignored"?
Let me also mention this is a specific environment (domain's forest has a long history, and forest and domain are single labeled).
Will in July 2022 this cause trouble in single label forest/domain environment?
This is part of the CVE-2021-42287 and Microsoft has assessed that this exploit is "less likely" so I wouldn't worry too much about it, as it will eventually get fixed automatically in future patches.
Hi!
Thank you for your reply!
So we can currently ignore this Event 37? And proceed with patching other domain controllers?
Should we push November 2021 updates on other domain controllers + emergency patch like we did with 1st domain controller?
Or should we skip November 2021 updates and install only emergency patch: "KB5008601" ?
with best regards
I would skip the November 9 update (KB5007192) and install the out-of-band update KB5008601, as the latter fixes issues that came with the November 9 update.
If you have already installed the November 9 update (KB5007192), install the KB5008601 on top of it and you should be good, the events can be ignored for now.
Thank you for your answer.
My last question:
Do current EVENT ID's 37 mean we will need to do something before July 2022?
Do this warnings mean that we currently have some misconfiguration in our environment that needs to be fixed before entering July2022?
These warnings are normal until all your DCs has the enforcement mode enabled, it will be automatically forced in upcoming July 2022 updates.
@Leon Laude - I am still trying to understand the meaning of warning message: "The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket."
How and when will this ticket contain information? Do we need to do anything on our side on AD level?
Btw we have also noticed that beside Event ID 37, there are also ocasionally Event ID 35 seen currently on that DC that was only patched with NOV21+emergency patch (we haven't started patching other DC's).
With best regards
As already stated, these events/warnings are normal until all your DCs has the enforcement mode enabled.
The link contains some official information about both event 35, 36 and 37.
That’s all we know for now.