Windows Server: Kerberos certificate-based authentication enforced on domain controllers (KB5014754)
Following CVE-2022-26923, CVE-2022-26931 and CVE-2022-34691, domain controllers require strong certificate mappings for Kerberos certificate-based authentication. Since the September 9, 2025 update, the option to revert to Compatibility mode is no longer supported, so certificates without strong mapping are rejected. The change is live.
Microsoft · Windows Server
