The November 2022 Microsoft patch KB5020805 hardens Kerberos and Netlogon protocols, which invalidates Kerberos signatures and causes Okta Advanced Server Access (ASA) Active Directory (AD)-joined Remote Desktop Protocol (RDP) connections to fail. Applying the Microsoft out-of-band update or the December 2022 monthly rollup update resolves the issue.

Applying the patch to domain controllers causes RDP issues when using ASA with the AD-joined feature. A login attempt with an AD-joined password fails with an error on the RDP session:

The username or password is incorrect. Try again.

After this error, the username field at the login prompt populates in an incorrect format, <domain>\<user>@<domain>. A login attempt with an AD-joined passwordless fails with an error about smart card certificate authentication. The ASA Gateway debug logs omit a specific error message, but a packet capture between the target server and the domain controller shows the domain controller rejecting the target server's request for a Kerberos ticket with an unsupported encryption type error.

KRB Error: KRDB5KDC_ERR_ETYPE_NOSUPP

Domain controller event logs (Kerberos-Key-Distribution-Center) contain a coinciding error:

While processing an AS request for target service krbtgt, the account testuser did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : 18 17 23 24 -135 3. The accounts available etypes : 23 18 17. Changing or resetting the password of testuser will generate a proper key.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Advanced Server Access (ASA)
• Active Directory (AD)-joined feature

The Microsoft patch KB5020805 applies security hardening for Kerberos and Netlogon and invalidates Kerberos signatures in certain environments.

• Microsoft KB article
• Microsoft acknowledgment of potential service disruption

How is the Microsoft patch issue resolved?

Resolve the specific Microsoft patch issue by applying the appropriate out-of-band update for the Windows Server version to the domain controller.

1. Apply the Microsoft out-of-band update released on November 17, 2022, to the domain controller.
   • Windows Server 2022: KB5021656
   • Windows Server 2019: KB5021655
   • Windows Server 2016: KB5021654

NOTE: As of December 2022, the fix for this issue is included in the monthly Microsoft rollup updates.

General Kerberos authentication troubleshooting steps.

Address general Kerberos authentication breakdowns between the target server and the domain controller by validating network connectivity and reviewing encryption policies.

1. Validate general network connectivity between the target server and the domain controller.
2. Review the compatibility of Group Policy Objects (GPOs) related to Kerberos encryption.