Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 27 subscribers
  • Views 28312 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Microsoft Update KB4012216 causing issues with STAS

Bianson

**Update** The update for Windows Server 2012R2 released on April 11th should resolve this issue.

The KB4012216 update from Microsoft is causing issues with STAS. Customers experiencing difficulty with STAS should roll back this update on their servers until Microsoft fixes the issue.

Thank you,

Bob



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to MattLinzbach

    MattLinzbach said:

    Can you elaborate on what problems customers are seeing?  Crashes, event IDs, users needing to log in, anything more specific would be helpful.

    Regards

     

    The bug causes the domain controller to stop logging EventID 4768 which causes STAS to no longer register the account logon events and send them to the firewall.

    Bob

  • 0 in reply to Bianson

    From https://www.reddit.com/r/sysadmin/comments/5zs0nc/heads_up_ms_kb4012213_andor_ms_kb4012216_disables/?st=j0kh8ocn&sh=9fc2f9c1

     

    We contacted Microsoft Premier Support and they informed us that it’s a bug in March updates and are working on fixing it. MS did supply us with this-

    Suggested workaround:

    The four audit policies you need to enable as a workaround to the bug are under Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon. All four policies under that heading should be enabled for Success and Failure:

    Audit Credential Validation

    Audit Kerberos Authentication Service

    Audit Kerberos Service Ticket Operations

    Audit Other Account Logon Events

    When you enable those four policies, you should start to see the 4768/4769 Success events again.

     

    Anyone having the issue cares to try?

    Regards,

    Giovani