RM CC4 Issues After Windows Updates – Changes to Kerberos RC4

[ITSystems_JamesE]

Good afternoon everyone,

We’ve recently been helping a number of schools running RM CC4 networks who have experienced issues following Microsoft’s latest Windows Server cumulative updates.

If your school has suddenly started seeing problems such as:
• RM Management Console not opening (server or workstation)
• User drive mappings failing
• Disk quotas not displaying correctly
• Devices showing offline in RM Management Console

• The system event log on a domain controller shows event ID 16 for KDC failures

…then you’re definitely not alone.

 

After investigating several affected sites, we’ve identified the issue as being related to Microsoft’s recent Kerberos security hardening changes. In many older CC4 environments, legacy RC4 encryption is now being restricted or blocked unless it has been manually re-enabled. This particularly impacts networks originally installed on CC4.2 (Windows Server 2003) and then upgraded to CC4 on Server 2016/19, where the RM Service Host account may still only contain older RC4 Kerberos keys.

 

The good news is that the issue can be resolved cleanly and safely without weakening domain security or re-enabling legacy encryption.
We’ve now successfully carried out a remedial fix across a number of schools which:
• Preserves the existing service account password
• Regenerates the required AES Kerberos keys
• Restores normal CC4 functionality
• Avoids re-enabling insecure RC4 encryption

The process is safe, non-disruptive, and we’ve seen excellent results so far, with schools back up and running normally shortly afterwards. With Microsoft continuing to tighten Kerberos security and further RC4 restrictions expected over the coming months, it’s probably worth checking sooner rather than later whether your environment may be affected.

In the interest of helping the community, we’re happy to offer advice, guidance, and where possible carry out the remedial work free of charge for schools currently experiencing the issue.

If you’d like some help, want to sense-check your symptoms, or simply want pointing in the right direction, feel free to send us a direct message and we’ll do our best to help.

 

IT Systems & Support Limited