On-premises Identity-related updates and fixes for August 2021

Reading Time: 3 minutes

Even though Microsoft’s Identity focus moves towards the cloud, they are not forgetting their on-premises roots. Windows Server 2016 and Windows Server 2019 still receive updates.

These are the Identity-related updates and fixes we saw for August 2021:

 

Windows Server 2016

We observed the following updates for Windows Server 2016:

KB5005043 August 10, 2021

The August 10, 2021 update for Windows Server 2016 (KB5005043), updating the OS build number to 14393.4583 is a a monthly cumulative update.

This update changes the default installation privilege requirement so that you must be an administrator to install drivers when using Point and Print. This mitigates the PrintNightmare Local Privilege Escalation (LPE) attacks.

This update also includes the following identity-related quality improvements:

  • It addresses an issue with Administrative Template settings in Group Policy. When an admin changes the value of the policy settings to Not configured, the system continues to apply the previous settings instead of removing them. This issue occurs after installing the June 2020 or later updates and is most noticeable with roaming user profiles.
  • It addresses an issue in which an extra dereference against a sign in session causes lsass.exe to stop working after the user signs out.

 

Windows Server 2019

We observed the following updates for Windows Server 2019:

KB5005030 August 10, 2021

The August 10, 2021 update for Windows Server 2019 (KB5005030), updating the OS build number to 17763.2114 is a monthly cumulative update.

This update changes the default installation privilege requirement so that you must be an administrator to install drivers when using Point and Print. This mitigates the PrintNightmare Local Privilege Escalation (LPE) attacks.

It also includes the following identity-related quality improvements:

  • It addresses a timing issue in the Group Policy Registry Telemetry that causes Group Policy extension processing to fail.
  • It addresses an issue in that might cause the Local Security Authority Subsystem Service (LSASS) process on Active Directory domain controllers to stop working under high load scenarios.
  • It addresses a Local Security Authority Subsystem Service (LSASS) domain controller memory leak that is reported in Privileged Access Management (PAM) deployments.
  • It addresses an issue that causes the enrollment of the Elliptic Curve Digital Signature Algorithm (ECDSA) certificate to fail when the Trusted Platform Module (TPM) provider (the Microsoft Software Key Storage Provider) stores the key. The error shown is:

0x80090027 NTE_INVALID_PARAMETER

  • It addresses an issue with auditing events 4624 and 5142 that display the wrong event template when Dutch is the display language.

KB5005102 August 26, 2021 Preview

The August 10, 2021 update for Windows Server 2019 (KB5005102), updating the OS build number to 17763.2145 is a preview update.

It includes the following Identity-related quality improvements:

  • It addresses an issue that causes Authentication Mechanism Assurance (AMA) to stop working. This issue occurs when you migrate to Windows Server 2016 (or newer versions of Windows) and when using AMA in conjunction with certificates from Windows Hello for Business.
  • It addresses an issue that might occur when you configure the Delete user profiles older than a specified number of days on system restart Group Policy setting. If a user has been signed in for longer than the time specified in the policy, the device might unexpectedly delete profiles at startup.
  • It addresses a race condition in the server message block (SMB) client that might slow the I/O for a connection until the I/O times out.

leave your comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.