KB4586830 question

Question

HI,

We must install KB4586830 on all of DC's in the domain.
I understand that after installing this upsdate we should also add this registery key "PerformTicketSignature" to

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Kdc

And set the value to 1, is this correct?

Also I hear that installing this update can create some problem in domain and if we come accross any problem we should install this update kb4594441, what this update do? does this update change the the above registry key as well? does anyone install this update?

Thanks

Answer 1

Yes, basically. I wouldn't necessarily expect problems but if you encounter the Kerberos authentication issues described here.
https://learn.microsoft.com/en-us/windows/release-information/status-windows-10-1607-and-windows-server-2016#november-2020

then installing this Out-of-band update (KB4594441) should resolve the issue.
https://support.microsoft.com/en-us/help/4594441

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

KB4586830 is the latest cumulative update for Server 2016 v1607
https://support.microsoft.com/en-us/help/4586830

KB4594441 is an Out-of-band update
https://support.microsoft.com/en-us/help/4594441

that resolves the Kerberos authentication issues mentioned here
https://learn.microsoft.com/en-us/windows/release-information/status-windows-10-1607-and-windows-server-2016#november-2020

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

More details here.
https://learn.microsoft.com/en-us/windows/release-information/status-windows-10-1607-and-windows-server-2016#november-2020

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky

Answer 5

@Vicky Wang Thanks for your reply,

We have 5 DC's in our domain from server 2012, 2012 R2 and server 2016.
If I understood it correctly we should first install the november update on all of our DC's at the same time and then set the Registry value on each DC to 1 and if we still come accross any issue we shuold insallt the cumulative updates on each of our DC's, is this correct?

Thanks