Protections for CVE-2025-26647 (Kerberos Authentication)

April 8, 2025: Initial Deployment phase – Audit mode

The initial deployment phase (Audit mode) starts with the updates released on April 8, 2025. These updates change the behavior that detects the elevation of privilege vulnerability described in CVE-2025-26647 but does not initially enforce it.

While in Audit mode, Event ID: 45 will be logged on the domain controller when it receives a Kerberos authentication request with an unsafe certificate. The authentication request will be allowed and no client errors are expected.

To enable the change in behavior and be secure from the vulnerability, you must ensure all Windows domain controllers are updated with a Windows update release on or after April 8, 2025, and the AllowNtAuthPolicyBypass registry key setting is set to 2 to configure for Enforcement mode.

When in Enforcement mode, if the domain controller receives a Kerberos authentication request with an unsafe certificate, it will log legacy Event ID: 21 and deny the request.

To turn on the protections offered by this update, follow these steps:

1. Apply the Windows update released on or after April 8, 2025, to all domain controllers in your environment. After applying the update, the AllowNtAuthPolicyBypass registry value is set to 1 which enables the NTAuth check and the Audit log warning events.
   
   IMPORTANT If you are not ready to proceed to apply the protections offered by this update, set the registry key to 0 to temporarily disable this change. See the Registry Key Information section for more information.

2. Monitor new events that will be visible on domain controllers to identify affected certificate authorities that are not part of the NTAuth store. The Event ID you need to monitor is Event ID: 45. See the Audit Events section for more information about these events.

3. Ensure all client certificates are valid and chained to a trusted Issuing CA in the NTAuth store.

4. After all Event ID: 45 events are resolved, then you can proceed to Enforcement mode. To do this, set the AllowNtAuthPolicyBypass registry value to 2. See the Registry Key Information section for more information.
   
   Note We recommend to temporarily delay setting AllowNtAuthPolicyBypass = 2 until after applying the Windows update released after May 2025 to domain controllers which service self-signed certificate-based authentication used in multiple scenarios. This includes domain controllers which service Windows Hello for Business Key Trust and Domain-joined Device Public Key Authentication.

July 2025: Enforced by Default phase

Updates released in or after July 2025 will enforce the NTAuth Store check by default. The AllowNtAuthPolicyBypass registry key setting will still allow customers to move back to Audit mode if needed. However, the ability to completely disable this security update will be removed.

October 2025: Enforcement mode

Updates released in or after October 2025 will discontinue Microsoft support for the AllowNtAuthPolicyBypass registry key. At this stage, all certificates must be issued by authorities that are a part of NTAuth store. 

Registry Key Information

The following registry key allows for auditing vulnerable scenarios and then enforcing the change once vulnerable certificates are addressed. The registry key will not be created automatically. The behavior of the OS when the registry key is unconfigured will depend on which phase of the deployment it is in.

AllowNtAuthPolicyBypass

Audit Events

Event ID: 45 | NT Auth Store Check Audit Event

Administrators should watch for the following event added by the installation of Windows updates released on or after April 8, 2025. If it exists, it implies that a certificate was issued by an authority that is not part of the NTAuth store.

Event ID: 21 | AS-REQ Failure Event

After addressing Kerberos-Key-Distribution-Center Event 45, the logging of this generic, legacy event indicates that the client certificate is still NOT trusted. This event may be logged for multiple reasons, one of which is that a valid client certificate is NOT chained to an Issuing CA in the NTAuth store.