MC1050817 – M365 Change Digest

One-line summary

Starting with the April 2025 Windows security update, Enforcement phase for Kerberos PAC Validation begins, removing Compatibility mode and requiring all domain controllers and clients to update for security compliance.

Similar updates

Details

Body (from Message Center)

Last year, Windows updates released on and after April 9, 2024 added new behaviors that start the process of addressing a security risk in the Kerberos PAC Validation Protocol.

Starting today, the Enforcement phase of deployment begins. After installing the April 2025 Windows security update and later updates on all Windows domain controllers and Windows clients, support for Compatibility mode will be removed, and the new secure behavior will be enabled by default. This will properly mitigate the vulnerabilities described in CVE-2024-26248 and CVE-2024-29056.

When will this happen?

The Enforcement phase starts today with the release of the April 2025 Windows security update.

How will this affect your organization?

To mitigate the risks described in CVE-2024-26248 and CVE-2024-29056, you must update your entire Windows environment. This must include all Windows domain controllers and Windows clients. Environments that are not up to date will not recognize the new request structure and security checks will fail.

What do you need to do to prepare?

Install the April 2025 Windows security update on all Windows domain controllers and Windows clients. Enforcement mode will be fully enabled in your environment. This will properly mitigate the vulnerabilities described in CVE-2024-26248 and CVE-2024-29056.

Additional information:

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [
      "Install April 2025 Windows security update on all domain controllers and clients"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Starting with the April 2025 Windows security update, Enforcement phase for Kerberos PAC Validation begins, removing Compatibility mode and requiring all domain controllers and clients to update for security compliance.",
    "ai_topics": [
      "Windows"
    ],
    "category": "stayInformed",
    "details_map": {},
    "id": "MC1050817",
    "importance": 5,
    "is_major_change": false,
    "last_modified": "2025-04-08T17:01:58Z",
    "ms_products": [
      "Windows"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Windows"
    ],
    "severity": "normal",
    "tags": [
      "Admin impact"
    ],
    "title": "Immediate Action: Enforce PAC Validation for CVE-2024-26248 \u0026 CVE-2024-29056"
  }
}