Note
- Original publish date: October 30, 2026
- KB ID: 5134907
Symptoms
After Windows security updates released on or after October 13, 2026, are installed on Active Directory domain controllers, some organizations using Azure NetApp Files or NetApp ONTAP might be unable to access SMB shares. Applications that depend on these shares might also be disrupted. New SMB volume creation might fail with an “Invalid credentials” error. Operations that depend on Active Directory Lightweight Directory Access Protocol (LDAP), including domain discovery, name mapping, and user or group lookups, might also fail with this error.
This issue affects Azure NetApp Files and NetApp ONTAP configurations that connect to Active Directory LDAP with LDAP client session security set to none.
Cause
The October 2026 cumulative security updates for Windows Server introduce security hardening requirements for domain controllers. All authentication to Windows Active Directory LDAP endpoints requires a valid LDAP service ticket that matches a registered service principal name (SPN) on the target domain controller after installing Windows updates released on or after October 13, 2026. This verification prevents callers from using a Kerberos ticket intended for a service other than LDAP to authenticate to LDAP.
For Azure NetApp Files and NetApp ONTAP configurations that connect to Active Directory LDAP with LDAP client session security set to none, ONTAP authenticates to Active Directory LDAP by using a Kerberos service ticket for the domain controller's CIFS service principal name (cifs/domain-controller-fqdn). However, after the security hardening, LDAP binds are accepted only with a ticket for the LDAP service principal name (ldap/domain-controller-fqdn).
As a result, the domain controller rejects the bind and returns the “Invalid credentials” error. The affected LDAP server can also be marked unusable for that storage virtual machine (SVM).
Resolution
Important: This section contains information about modifying the registry. Before you modify the registry, back it up and make sure that you know how to restore it if a problem occurs. For more information, see How to back up and restore the registry in Windows.
For self-managed ONTAP customers, NetApp recommends configuring LDAP session security to use sign or seal on each affected storage virtual machine. When session-security-for-ad-ldap is set to sign or seal, ONTAP requests a ticket for the LDAP SPN and the bind succeeds. Consult NetApp support for the latest solutions and guidance before making changes to the ONTAP configuration.
NetApp is working to provide a resolution that will allow customers to install Windows security updates without disrupting access to affected Azure NetApp Files resources. Consult the NetApp Knowledge Base for the latest information.
Until the NetApp resolution for Azure NetApp Files can be applied, IT administrators who cannot configure the LDAP session security to use sign or seal can temporarily disable LDAP SPN verification on affected domain controllers:
Open Registry Editor.
Navigate to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Create or modify the following registry value:
Value name: LdapSPNVerificationLevel
Value type: REG_DWORD
Value data: 0
This registry configuration should only be used temporarily. Restore the default value of 1 when it is safe to do so in your environment. The setting is applied dynamically, so a restart is not required.