ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 17:50 UTC Customize Public modeDiscuss ChangeIntel on Discord

Kerberos NTAuth protections

Timelines and exceptions · All guidance changes

Windows Server · Official Microsoft guidance

No content change seen yet. Watched since 12 Oct 19:19 UTC, last read 19 Oct 23:40 UTC, next check today 23:40 UTC.

Read the Microsoft source · Link to this observation · My radar

Timeline

From the capture of 12 Oct 19:19 UTC
Published timing needs confirmation October 2025 most recent · 11 months ago
  • 7 dates
  • 2 undated sections
  • 8 with conditions
  1. Audit / monitorin or after April 2025 Published timing is qualified; effectiveness is not confirmed.
  2. Audit / monitoron or after 8 Apr 2025 Published timing is qualified; effectiveness is not confirmed.
  3. Audit / monitorin or after May 2025 Published timing is qualified; effectiveness is not confirmed.
  4. Enforced9 May 2025 Published timing is qualified; effectiveness is not confirmed.
  5. Enforced by defaultin or after July 2025 Published timing is qualified; effectiveness is not confirmed.
  6. Audit / monitor22 Jul 2025 Published timing is qualified; effectiveness is not confirmed.
  7. Enforcedin or after October 2025 Published timing is qualified; effectiveness is not confirmed.
  1. 17 months agomonth windowin or afterAudit / monitor · unconfirmed
    • Protections for CVE-2025-26647 (Kerberos Authentication)MilestoneRequirementExceptionRecommendation5 conditions
      AllowNtAuthPolicyBypass
      Change date: July 22, 2025; Change description: Updated the paragraph under "Registry Key Information" in the "Registry Settings and Event Logs" section. Original text: The…
    • Commentsin Registry Key InformationExceptionRecommendation1 condition
      CurrentControlSetAllowNtAuthPolicyBypass
  2. 18 months agoon or afterAudit / monitor · unconfirmed
  3. 16 months agomonth windowin or afterafterAudit / monitor · unconfirmed
  4. 17 months agoEnforced · unconfirmed
    • Protections for CVE-2025-26647 (Kerberos Authentication)MilestoneRequirementExceptionRecommendation5 conditions
      AllowNtAuthPolicyBypass
      Change date: July 22, 2025; Change description: Updated the paragraph under "Registry Key Information" in the "Registry Settings and Event Logs" section. Original text: The…
  5. 14 months agomonth windowin or afterEnforced by default · unconfirmed
  6. 15 months agoAudit / monitor · unconfirmed
    • Protections for CVE-2025-26647 (Kerberos Authentication)MilestoneRequirementExceptionRecommendation5 conditions
      AllowNtAuthPolicyBypass
      Change date: July 22, 2025; Change description: Updated the paragraph under "Registry Key Information" in the "Registry Settings and Event Logs" section. Original text: The…
  7. 11 months agomonth windowin or afterEnforced · unconfirmed

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

Requirements, exceptions and scope

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured 12 Oct 19:19 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Extracted assertions require review · Publisher marks guidance tentative · Applicability or exceptions require review

0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Suggested by a shared curated topic and product; not a verified connection (6 items)

What changed

First observed 18 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 17:50 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.