This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Microsoft Update KB4012216 causing issues with STAS

**Update** The update for Windows Server 2012R2 released on April 11th should resolve this issue.

The KB4012216 update from Microsoft is causing issues with STAS. Customers experiencing difficulty with STAS should roll back this update on their servers until Microsoft fixes the issue.

Thank you,

Bob

This thread was automatically locked due to age.

0 Bill Roland over 8 years ago

Interesting, I am seeing major problems with STAS and I have it installed. Can you elaborate if it needs to be rolled back on the workstations or the servers or both? Do you know exactly what is causing the issue?

oh, and THANKS for the information, btw!
Cancel
Vote Up 0 Vote Down

Cancel
0 Bianson over 8 years ago in reply to Bill Roland

Issue just seems to be affecting server 2012 R2. I have now updated my original post.

You're welcome!
Cancel
Vote Up 0 Vote Down

Cancel
0 Bill Roland over 8 years ago in reply to Bianson

I have Server 2012R2 and seem to still be getting Event 4768 generated, so I assume this is not the cause of my STAS woes. Oh well, back to the drawing board.
Cancel
Vote Up 0 Vote Down

Cancel
0 MattLinzbach over 8 years ago

Can you elaborate on what problems customers are seeing? Crashes, event IDs, users needing to log in, anything more specific would be helpful.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Bianson over 8 years ago in reply to MattLinzbach

MattLinzbach said:

Can you elaborate on what problems customers are seeing? Crashes, event IDs, users needing to log in, anything more specific would be helpful.

Regards

The bug causes the domain controller to stop logging EventID 4768 which causes STAS to no longer register the account logon events and send them to the firewall.

Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 giomoda over 8 years ago in reply to Bianson

From https://www.reddit.com/r/sysadmin/comments/5zs0nc/heads_up_ms_kb4012213_andor_ms_kb4012216_disables/?st=j0kh8ocn&sh=9fc2f9c1

We contacted Microsoft Premier Support and they informed us that it’s a bug in March updates and are working on fixing it. MS did supply us with this-

Suggested workaround:

The four audit policies you need to enable as a workaround to the bug are under Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon. All four policies under that heading should be enabled for Success and Failure:

Audit Credential Validation

Audit Kerberos Authentication Service

Audit Kerberos Service Ticket Operations

Audit Other Account Logon Events

When you enable those four policies, you should start to see the 4768/4769 Success events again.

Anyone having the issue cares to try?

Regards,

Giovani
Cancel
Vote Up 0 Vote Down

Cancel
0 Bill Roland over 8 years ago

Just an FYI, I believe today's update rollup for Windows Server 2012R2 is supposed to address the issue.
Cancel
Vote Up 0 Vote Down

Cancel

Microsoft Update KB4012216 causing issues with STAS

Suggested workaround: