Microsoft KB Update (July 14, 2026) – Medium Severity

Products Threat Prevention News
, ,
1

threat-prevention-patch
threat-prevention-patch1920×960 169 KB

Want the full details? Click the link below!

On July 14, 2026, Microsoft released KB updates that conflict with Netwrix Threat Prevention (formerly StealthINTERCEPT) agents.
If these KBs are applied before updating the agents, certain NTLM and Kerberos authentication events will no longer be captured or blocked.

Netwrix recommends delaying the deployment of these KBs if your organization relies on these event types. The Netwrix development and QA teams are working on updated agents compatible with these KBs and will send another notice when they are available.

:double_exclamation_mark: Important Details

If your organization does not use Netwrix Threat Prevention (formerly StealthINTERCEPT) for the following activity event collection, or such events are not deemed important, you may elect to deploy the following Microsoft KBs in advance of updated Netwrix Threat Prevention (formerly StealthINTERCEPT) agents.

No other aspect of Netwrix Threat Prevention (formerly StealthINTERCEPT) operation is impacted by the July 14, 2026 KBs beyond what is described below. There is no adverse impact to domain controllers if the KBs are deployed without updating the agents.

Event Types Affected:

  • Kerberos Authentication activity (Windows Server 2025 & 2016)
  • NTLM Authentication activity (Windows Server 2022 & 2019)
  • Kerberos Authentication activity (Windows Server 2022 & 2019)

Severity:
MEDIUM

Affected Products:

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) for Active Directory
  • Netwrix Threat Manager (formerly StealthDEFEND) for Active Directory

Affected Systems:

  • Windows Server 2025 (for Active Directory)
  • Windows Server 2022 (for Active Directory)
  • Windows Server 2019 (for Active Directory)
  • Windows Server 2016 (for Active Directory)

Affected Microsoft KBs:

  • Windows Server 2025 – KB5099536
  • Windows Server 2022 – KB5099540
  • Windows Server 2019 – KB5099538
  • Windows Server 2016 – KB5099535

Impact:

Functional:
Windows Server 2025 – KB5099536

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) agents will lose the ability to capture or block Kerberos authentication activity.
  • Log: Couldn’t resolve I_GetASTicket
  • Log: Couldn’t resolve SslTryS4U2Self

Windows Server 2022 – KB5099540

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) agents will lose the ability to capture or block NTLM and Kerberos authentication activity.
  • Log: Couldn’t resolve NlpLogonSamLogon
  • Log: Couldn’t resolve NlpUserValidate
  • Log: Couldn’t resolve SslTryS4U2Self

Windows Server 2019 – KB5099538

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) agents will lose the ability to capture or block NTLM and Kerberos authentication activity.
  • Log: Couldn’t resolve NlpLogonSamLogon
  • Log: Couldn’t resolve NlpUserValidate
  • Log: resolving KdcVerifyKdcRequest failed
  • Log: Couldn’t resolve SslTryS4U2Self

Windows Server 2016 – KB5099535

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) agents will lose the ability to capture or block Kerberos authentication activity.
  • Log: Couldn’t resolve SslTryS4U2Self

Stability:
No stability impact on any server platforms or domain controllers

What are your thoughts?

We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!

1 Like
Threat Prevention Bug Fix List
Agent Packages for Microsoft KB Update (July 14, 2026) Released
2

Hello,

Is there an august bulletin, with patch Tuesday being yesterday and nothing announced or updated yet?

If there is an Netwrix august release patch to fix any issues with the Microsoft patches, assume nothing affecting stability?

Thanks
Lee

3

I didn’t receive an email alert about this, did you all send one out?

4

Hi Jay, Lee,

There were no breaking changes in this Patch Tuesday, so there was no announcement.

Thanks,
Tania

2 Likes
5

This is great news! For me personally, I would like to have a note from you all stating that there is no agent this month due to this, just so that I can have an official statement saying it’s okay to move forward with the KBs for this month. It’s been awhile since this has happened, and it would be helpful to be able to show people here that we can proceed. Thank you!

2 Likes
6

Agreed. “No News is good news” but seeing an email that it’s NOT affecting anything is much better.

2 Likes
7

Thanks, Jay and Sai. Going forward if a Patch Tuesday has no breaking changes that require an AD agent update, I will post a note about it.

2 Likes