Newsletter Archives

  • MS-DEFCON 3: Side effect with Domain patch

    alert banner

    Special alert

    MS-DEFCON 3

    By Susan Bradley

    November Domain controller update leads to memory leak

    Business patchers only:  Microsoft has posted up a known side effect introduced by the November updates applied to domain controllers.

    As they note in their health release: (with my slight edits for clarification)

    After installing November or later updates on Domain Controllers (DCs), you might experience a memory leak with Local Security Authority Subsystem Service (LSASS,exe). Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart. Note: The out-of-band updates for DCs released November 17, 2022 and November 18, 2022 do not fix the issue and are also affected by this issue.

    Workaround one if you can remove the patch: Uninstall the November 8th updates and out of band updates that are listed here.

    Workaround two if you are mandated to keep the patch installed: To mitigate this issue, open Command Prompt as Administrator and use the following command to set the registry key KrbtgtFullPacSignature to 0:

    • reg add “HKLM\System\CurrentControlSet\services\KDC” -v “KrbtgtFullPacSignature” -d 0 -t REG_DWORD

    Note that this ONLY impacts business patchers and does NOT impact consumers.

  • MS-DEFCON 3: Issues with domains

    alert banner

    ISSUE 19.47.1 • 2022-11-22

    MS-DEFCON 3

    By Susan Bradley

    November updates lead to side effects

    My usual advice regarding updates with known side effects is to wait until the problems are resolved. But every so often, the risk of waiting is greater than the risks associated with the side effects.

    That’s the way I see the situation now. The November updates require you to slog through the issues and deal with the side effects. For that reason, I’m lowering the MS-DEFCON level to 3. I’d really like to go to 4, but I think greater caution is required.

    Anyone can read the full MS-DEFCON Alert (19.47.1, 2022-11-22).