November 2022 Windows Updates Changes

[free780]

I would imagine most environments should be Ok with the changes. You can monitor changes before enforcement.

https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

How to manage the Kerberos protocol changes related to CVE-2022-37966

https://support.microsoft.com/en-us/topic/kb5020805-how-to-manage-kerberos-protocol-changes-related-to-cve-2022-37967-997e9acc-67c5-48e1-8d0d-190269bf4efb

How to manage Kerberos protocol changes related to CVE-2022-37967

https://support.microsoft.com/en-gb/topic/kb5021130-how-to-manage-the-netlogon-protocol-changes-related-to-cve-2022-38023-46ea3067-3989-4d40-963c-680fd9e8ee25

How to manage the Netlogon protocol changes related to CVE-2022-38023

https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1

Active Directory permissions updates (CVE-2021-42291)

can't replicate this issue.

[free780]

The RC4 change has caused some issues.

 

 

Looks like where a group policy setting has clashed with the change.

[HPlum78]

Just in case you have not seen this (we have a ticket open) these updates stop GMSA from working...

[MYK-IT]

Hi,

 

Just wondered from those who have applied these updates so far, how did it go?

 

With CVSS scores being above 7 (CVE-2022-37966 - 8.1, CVE-2022-37967 - 7.2 & CVE-2022-38023 - 8.1) and to ensuring ongoing compliancy with Cyber Essentials this only gives to next Tuesday (22nd November 2022) to apply the updates etc. I realise that elements of it can/do go into Audit mode initially (pending mandatory activation at some stage next year via another Microsoft Update).

 

Provisionally, I have run this script on Domain Controller(s)

 

Get-ADObject -properties msDS-SupportedEncryptionTypes -filter * | ? { (($_.'msDS-SupportedEncryptionTypes' -BAND 0x3F) -NE 0) -AND (($_.'msDS-SupportedEncryptionTypes' -BAND 0x38) -EQ 0)} | Select Name, msDS-SupportedEncryptionTypes | Sort-Object Name

 

with no results returned (which I believe is a good start?) but presumably the Event Logs still need to be monitored as per the various MS KB articles.

 

Thanks,

Edited November 14, 2022 by MYK-IT

[MYK-IT]

OOB update to address an issue with sign in and Kerberos authentication

MC468176 · Published 17 Nov 2022

 

MAJOR UPDATE

 

Message Summary

Microsoft is releasing Out-of-band (OOB) security updates today, November 17, 2022. This update addresses a known issue for installation on all the Domain Controllers (DCs) in your environment. You do not need to install any update or make any changes to other servers or client devices in your environment to resolve this issue. If you used any workaround or mitigations for this issue, they are no longer needed, and we recommend you remove them.

 

To get the standalone package for these out-of-band updates, search for the KB number in the Microsoft Update Catalog. You can manually import these updates into Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. For WSUS instructions, see WSUS and the Catalog Site. For Configuration Manger instructions, see Import updates from the Microsoft Update Catalog. Note The below updates are not available from Windows Update and will not install automatically.

 

Cumulative updates:

 

• Windows Server 2022: KB5021656
  
• Windows Server 2019: KB5021655
  
• Windows Server 2016: KB5021654
  

Note: You do not need to apply any previous update before installing these cumulative updates. If you have already installed updates released November 8, 2022, you do not need to uninstall the affected updates before installing any later updates including the updates listed above.

 

Standalone Updates:

 

• Windows Server 2012 R2: KB5021653
  
• Windows Server 2012: KB5021652
  
• Windows Server 2008 R2 SP1: This update is not yet available. Please check here in the coming week for more information.
  
• Windows Server 2008 SP2: KB5021657
  
• 
  

Note: If you are using security only updates for these versions of Windows Server, you only need to install these standalone updates for the month of November 2022. Security only updates are not cumulative, and you will also need to install all previous Security only updates to be fully up to date. Monthly rollup updates are cumulative and include security and all quality updates. If you are using Monthly rollup updates, you will need to install both the standalone updates listed above to resolve this issue, and install the Monthly rollups released November 8, 2022 to receive the quality updates for November 2022. If you have already installed updates released November 8, 2022, you do not need to uninstall the affected updates before installing any later updates including the updates listed above.