Certificate Authority Archives

Winsage

June 12, 2025

Microsoft Resolves Windows Server 2025 Restart Bug Disrupting Active Directory Connectivity

Microsoft released updates in June 2025 to address critical issues affecting Windows Server 2025 domain controllers, specifically authentication failures and network connectivity problems. The updates, encapsulated in KB5060842, resolved issues stemming from security update KB5055523, which altered certificate validation methods for Kerberos authentication. This change led to logging errors for self-signed certificates and affected Windows Hello for Business Key Trust deployments. Additionally, a separate issue prevented domain controllers from managing network traffic correctly after restarts, causing them to revert to standard firewall profiles. Microsoft provided a temporary workaround for administrators to manually restart network adapters until a permanent fix was implemented. The June updates addressed a total of 66 vulnerabilities, including 10 rated as Critical, and recommended immediate installation. Microsoft advised against setting the AllowNtAuthPolicyBypass registry key to ‘2’ for domain controllers using self-signed certificates until the latest updates were applied.

Winsage

May 7, 2025

Microsoft: April updates cause Windows Server auth issues

Microsoft has acknowledged that the April 2025 security updates are causing authentication challenges for certain Windows Server domain controllers, specifically affecting Windows Server versions 2016, 2019, 2022, and 2025. The issues arise after installing the April Windows monthly security update (KB5055523 or later), leading to complications in processing Kerberos logons or delegations that rely on certificate-based credentials. Affected authentication protocols include Kerberos PKINIT, S4U via RBKCD, and KCD. These issues are linked to security measures addressing the critical vulnerability CVE-2025-26647, which allows authenticated attackers to escalate privileges remotely. A temporary workaround involves modifying a registry value. Microsoft has previously addressed similar authentication issues in Windows 11, Windows Server 2025, and earlier versions.

Winsage

February 5, 2025

Microsoft addresses Windows vulnerability with PowerShell script

Microsoft has introduced a PowerShell script, KB5053484, to address the 2023 BlackLotus Secure Boot vulnerability (CVE-2023-24932) in Windows operating systems. This update targets Windows-bootable media and aligns with the new Secure Boot Certificate Authority (CA) released in February 2024, replacing the outdated CA from 2011. The BlackLotus vulnerability allows attackers to bypass Secure Boot in Windows 10 and 11, potentially injecting harmful code at the UEFI level. The update is available immediately to enhance security against this threat.

Winsage

February 5, 2025

KB5053484: Microsoft shares new PowerShell script for updated Windows 11/10 boot media

In February 2024, Microsoft announced the rollout of new 2023 Secure Boot Certificate Authority (CA) keys to replace the 2011 certificates that were introduced with Windows 8. This initiative began with Patch Tuesday updates, specifically KB5034765 for Windows 11 and KB5034763 for Windows 10, as the 2011 certificates are set to expire in 2026. Microsoft released a PowerShell script, Make2023BootableMedia.ps1, to update Windows bootable media for compatibility with the new Windows UEFI CA 2023 certificate, addressing the Black Lotus Secure Boot vulnerability (CVE-2023-24932). The script can update various types of bootable media, including ISO files, USB drives, and local or network drive paths. Users must have the latest Windows Assessment and Deployment Kit (Windows ADK) for the script to function properly, and it should be executed from an elevated PowerShell prompt with the appropriate media source provided. Comprehensive details are available in the KB5053484 support article on Microsoft's website.