Anyone having issues with domain controller (2019)...
# citrix-vadd
David
01/16/2025, 10:31 AMAnyone having issues with domain controller (2019) windows update KB5050008 with Citrix FAS Logons?
After update was installed the following error occured in sec log on dc: Kerberos pre-authentication failed. Error 4771
After uninstalling update, everything works fine again.
👀 1
c
c4rm0
01/16/2025, 11:17 AMdid FAS stop working (SSO not working to VDA's ) ? what version of FAS servers do you have ?. I do recall seeing a post for some cert based auth changes on domain controllers on here a few weeks ago https://worldofeuc.slack.com/archives/CKHRXATV2/p1736527472248739
d
David
01/16/2025, 11:53 AMSSO to Storefront worked, just the logon to the session hosts does not work.
Another trusted domain where the dcs where not updated works just fine - seems to be related to the changes of cert auth you mentioned.
David
01/16/2025, 11:58 AMimage.png
c
c4rm0
01/16/2025, 12:03 PM2402 FAS added the SID parameter in the cert request from FAS to CA in preperation for KB5014754
c4rm0
01/16/2025, 12:04 PMfrom your screenshot i cant make out what version of FAS that is
c4rm0
01/16/2025, 12:05 PMimage.png
👍 1
💯 1
c4rm0
01/16/2025, 12:25 PMSounds like to me your DC's was patched which enabled the StrongCertificateBindingEnforcement Enforcement mode (Even though in KB it says this gets enabled as part of the FEB 2025 updates) and because your FAS server was on 2308 it wasnt sending the SID parameter in the FAS to CA cert request for users and your DC's was blocking it due to weak mapping type. Do you see any of the below event ids on your DC's ?
d
David
01/16/2025, 1:10 PMI was already checking the logs on the DCs, i can not see any of the mentioned event ids - i will try the settings after updating one server and test the auth again.
Thanks for helping out!
2 Views