Windows Server: Kerberos certificate-based authentication enforced on domain controllers (KB5014754)
Summary
Following CVE-2022-26923, CVE-2022-26931 and CVE-2022-34691, domain controllers require strong certificate mappings for Kerberos certificate-based authentication. Since the September 9, 2025 update, the option to revert to Compatibility mode is no longer supported, so certificates without strong mapping are rejected. The change is live.
What changes?
Certificate-based logons (for example smart card or certificate logons) fail if the certificate has no strong mapping and no SID extension. The KDC logs Kdcsvc events 39, 40 and 41 in the System log (41, 48 and 49 on Windows Server 2008 R2 SP1 and 2008 SP2). In Enforcement mode, authentication is denied.
Affected
- Windows domain controllers that service certificate-based authentication
- Servers running Active Directory Certificate Services
- Windows Server 2012 R2, 2012, 2016, 2019, 2022, version 20H2, 2008 R2 ESU and 2008 SP2 (per KB5014754)
Preparation and temporary exceptions
- Check the System log on domain controllers for Kdcsvc events 39, 40 and 41.
- Reissue affected certificates with the new SID extension.
- If reissuing is not possible, add a strong mapping to the altSecurityIdentities attribute of the user: X509IssuerSerialNumber (recommended), X509SKI or X509SHA1PublicKey.
- Reverse the forward format of Issuer and Serial Number when entering the mapping string.
Check and complete
Not a defect. Enforcement is the intended hardening. Verify that no Kdcsvc events 39, 40 or 41 are logged and that all certificates have strong mappings.
Recommendation
Check all domain controllers for Kdcsvc events, reissue certificates or add strong mappings in altSecurityIdentities, and avoid weak mapping types (X509IssuerSubject, X509SubjectOnly, X509RFC822). For certificates issued via Intune, see the linked Microsoft guidance on strong mapping.
Timeline
- May 2022 update adds Kdcsvc audit events and Compatibility mode for certificate-based authentication.
- Domain controllers move to Full Enforcement mode if StrongCertificateBindingEnforcement is not configured; moving back to Compatibility mode remains possible.
- Enforcement mode date: the option to move back to Compatibility mode ends with the September 9, 2025 security update.
Sources
- KB5014754: Certificate-based authentication changes on Windows domain controllers Vendor · support.microsoft.com
- Support tip: Implementing strong mapping in Microsoft Intune certificates Vendor · techcommunity.microsoft.com
- CVE-2022-26923 Vendor · msrc.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:16.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.