KB5037754 Advisory: Key Changes to PAC Validation & Security Vulnerabilities

Microsoft has issued an important advisory and update, KB5037754, which introduces significant changes to the Privilege Attribute Certificate (PAC) validation protocol—a core part of Windows authentication security—alongside addressing critical security vulnerabilities tracked as CVE-2024-26248 and CVE-2024-29056. This article provides a detailed examination of the advisory’s technical details, its implications for Windows environments, and best practices for IT administrators and enterprises preparing for the update’s phased rollout.

Background: The Role of PAC in Windows Authentication

The Kerberos authentication protocol underpins identity and access management in Windows domains and Active Directory environments. A key component within Kerberos tickets is the Privilege Attribute Certificate (PAC), which carries user privilege and group membership data crucial for access control decisions.

PAC validation involves cryptographic signature checks ensuring that the PAC data has not been tampered with, preserving authentication integrity. Weaknesses in PAC signature validation or its cross-domain filtering logic can lead to privilege elevation or impersonation attacks, threatening enterprise security.

Overview of KB5037754 and Vulnerabilities Addressed

KB5037754 focuses on enhancing PAC validation by eliminating known security gaps and improving enforcement of signature verification. Two specific vulnerabilities addressed include:

  • CVE-2024-26248: A flaw allowing an attacker or process to spoof PAC signatures, effectively circumventing existing protections and potentially leading to unauthorized privilege escalation.
  • CVE-2024-29056: A security issue affecting PAC validation in cross-forest authentication scenarios, which could enable privilege escalation across trusted domain boundaries.

The update strengthens PAC signature verification mechanisms and cross-domain filtering logic to close these exploitation avenues.

Phased Rollout: Compatibility, Enforcement, and Finalization

Microsoft is deploying KB5037754 with a thoughtfully phased approach to balance security and operational compatibility:

1. Compatibility Mode (April 2024 – January 2025)

  • The update is initially deployed in "Compatibility mode," where the new PAC validation logic exists but is not enforced by default.
  • Systems with updated domain controllers and clients continue interoperating with devices that have not installed the update, reducing immediate disruption.
  • Audit events are generated to help administrators identify devices or services that lack the update and may be incompatible.

2. Enforced Mode By Default (Starting January 2025)

  • From January 2025, the update automatically switches systems into "Enforced mode," where strict PAC validation becomes default.
  • Although administrators can temporarily revert to Compatibility mode via specific registry keys (INLINECODE0 and INLINECODE1 ), this flexibility is limited and intended only as a transitional measure.
  • Organizations must address compatibility issues during this phase to avoid authentication failures.

3. Absolute Enforcement (April 2025 and Beyond)

  • After April 2025, Compatibility mode is removed altogether.
  • Registry-based overrides for PAC validation are disabled, making the enhanced security mandatory without fallbacks.
  • Devices not updated or incompatible will face authentication failures—especially those participating in cross-domain or cross-forest environments where trust relationships rely on PAC data.

Technical Details and Enhancements

PAC Validation Process

When a workstation receives a Kerberos ticket, it verifies the PAC, which contains authorization attributes required for resource access. In trusted multi-domain setups, the ticket traverses multiple domain controllers, leveraging filtered authorization data.

KB5037754 enhances:

  • PAC signature verification to prevent spoofing.
  • Cross-domain filtering mechanisms to ensure only authorized privileges cross forest trust boundaries.

New Audit Event Logging

To aid administrators, the update introduces enhanced audit event logging:

  • Event ID 21: Kerberos Ticket Logon Action — logs processed tickets and filtered security identifiers.
  • Event ID 22: Kerberos Ticket Logon Failure — highlights authentication denials under the new PAC validation rules.
  • Event ID 23: Kerberos Ticket Logon Fallback — warns of fallback or failure when strict validation cannot be met.
  • Event ID 5842/5843: Netlogon related failures indicating domain trust or ticket forwarding issues.

These events are crucial for administrators to identify problematic devices before final enforcement.

Registry Keys for Transition Control

Administrators receive temporary tools to manage the transition:

  • INLINECODE2 : Controls PAC signature enforcement level (default 2 in Compatibility mode; 3 for enforced).
  • INLINECODE3 : Configures the cross-domain filtering strictness.
  • INLINECODE4 : Controls audit logging verbosity.

Careful management of these keys facilitates a measured, secure upgrade path.

Impact and Implications for Organizations

Security Benefits

  • Closing Elevated Privilege Attacks: Eliminates attack vectors where malicious actors could impersonate users or elevate privileges undetected.
  • Strengthened Identity Trust: Ensures cross-domain trust boundaries are more robust, protecting against lateral movement threats in enterprise networks.
  • Greater Visibility: Enhanced auditing and event logging improve incident detection and response capabilities.

Risks and Challenges

  • Legacy System Breakage: Older or unpatched devices with incompatible Kerberos or PAC implementations risk authentication failure.
  • Cross-Forest Authentication Outages: Enterprises with complex multi-domain forests must coordinate carefully to avoid service disruption.
  • Operational Readiness: The transition requires inventorying assets, applying patches, testing, and communicating changes to stakeholders—failure to do so could compromise business continuity.

Recommendations for IT Administrators and Enterprises

  • Complete Asset Inventory: Identify all devices participating in Kerberos authentication, including domain controllers and clients.
  • Prioritize Patch Deployment: Install KB5037754 and related updates promptly across the environment, especially domain controllers.
  • Monitor Audit Logs: Regularly review new event IDs to detect unpatched or incompatible devices.
  • Engage in Testing and Piloting: Use test environments to validate the update’s impact before wide deployment.
  • Coordinate Across Teams and Domains: Plan and communicate with stakeholders managing various domains or forests to ensure seamless interoperability.
  • Update Legacy Systems: Where possible, upgrade or replace outdated systems that may not support enforced PAC validation.
  • Plan for Windows 10 Migration: Align this update with Windows 10 end-of-support in October 2025, migrating to Windows 11 to maintain security compliance.

Broader Context: Windows Security Hardening in 2024 and Beyond

KB5037754 is part of a series of security enhancements Microsoft is deploying to harden Windows authentication, including:

  • Strict Netlogon and Kerberos protocol enforcement.
  • Enhanced Secure Boot protections against firmware attacks.
  • Certificate validation improvements in Active Directory environments.

These initiatives collectively support Microsoft's zero-trust security framework aimed at minimizing attack surfaces and ensuring identity integrity across Windows ecosystems.

Conclusion

Microsoft’s KB5037754 update introduces crucial enhancements to PAC validation designed to protect Windows domains from privilege escalation and unauthorized access vulnerabilities. Through a phased rollout beginning April 2024 and culminating in mandatory enforcement by April 2025, organizations have a critical window to prepare their environments.

System administrators and enterprise IT decision-makers must approach this update as a business imperative to safeguard authentication infrastructures. Proper planning, testing, and prompt patching will ensure a smooth transition to a more secure Windows authentication landscape.

  • Microsoft Security Advisory KB5037754 and associated CVE details were analyzed from internal sources and patch documentation extracted from Windows forums and technical archives,,,,.

If required, direct Microsoft documentation could be found and verified on their official security portal or Windows update catalog websites.