ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Recorded 18 Oct 2026 at 23:19 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

Guidance timelinesupport.microsoft.com

Certificate mapping enforcement

Microsoft's guidance publishes 16 dates, from 10 May 2022 to 10 Sep 2025 (KB5014754: Certificate-based authentication changes on Windows domain controllers).

Permanent link to this revision

What it said

Take action
10 May 2022 · Audit / monitor, tentative, conditional
KB5014754: Certificate-based authentication changes on Windows domain controllers
26 Jan 2023 · Enforced
KB5014754: Certificate-based authentication changes on Windows domain controllers (2)
14 Feb 2023 · Enforced
KB5014754: Certificate-based authentication changes on Windows domain controllers (3)
11 Apr 2023 · Enforced, conditional
KB5014754: Certificate-based authentication changes on Windows domain controllers (4)
19 May 2023 · Enforced
KB5014754: Certificate-based authentication changes on Windows domain controllers (5)
30 Jun 2023 · Enforced
KB5014754: Certificate-based authentication changes on Windows domain controllers (6)
10 Oct 2023 · Enforced by default
KB5014754: Certificate-based authentication changes on Windows domain controllers (7)
14 Nov 2023 · Enforced
Timeline for Windows updates
13 Feb 2024 · Opt-in
KB5014754: Certificate-based authentication changes on Windows domain controllers (8)
10 Sep 2024 · Enforced by default
KB5014754: Certificate-based authentication changes on Windows domain controllers (9)
24 Oct 2024 · Enforced
Take action (2)
February 2025 · Enforced by default, conditional
KB5014754: Certificate-based authentication changes on Windows domain controllers (10)
11 Feb 2025 · Enforced, conditional
Registry key information
September 2025 or later · Retired / removed, conditional
KB5014754: Certificate-based authentication changes on Windows domain controllers (11)
9 Sep 2025 · Audit / monitor, conditional
KB5014754: Certificate-based authentication changes on Windows domain controllers (12)
10 Sep 2025 · Enforced
Settings named
Enrollment-Flag, StrongCertificateBindingEnforcement, X509IssuerSerialNumber, X509IssuerSubject, A1B2C3, C3B2A1, CertificateMappingMethods

What changed

First observed 18 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.