Microsoft KB Update (June 9, 2026) – Medium Severity

Products Threat Manager News
, ,
1

threat-manager-patch
threat-manager-patch1920×960 170 KB

Want the full details? Click the link below!

On June 9, 2026, Microsoft released KB updates that conflict with Netwrix Threat Prevention agents used by Threat Manager for AD to collect AD event data. If these KBs are applied before updating the agents, certain LDAP and Kerberos events will no longer be captured or blocked.

Netwrix recommends delaying the deployment of these KBs if the impacted event types are important to your organization. The Netwrix development and QA teams are working on updated agents compatible with these KBs and will send another notice when they are available.

:double_exclamation_mark: Important Details
If your Threat Manager for AD deployment does not use Threat Prevention agents for the following activity event collection, or such events are not deemed important, you may elect to deploy the following Microsoft KBs in advance of updated Netwrix Threat Prevention agents.

No other aspect of Threat Manager operation is impacted by the June 9, 2026 KBs beyond what is described below. There is no adverse impact to domain controllers if the KBs are deployed without updating the agents.

Event Types Affected:

  • Kerberos Authentication activity
  • LDAP Bind activity

Severity:
MEDIUM

Affected Products:

  • Netwrix Threat Prevention (formerly StealthINTERCEPT) for Active Directory
  • Netwrix Threat Manager (formerly StealthDEFEND) for Active Directory

Affected Systems:

  • Windows Server 2025 (for Active Directory)
  • Windows Server 2022 (for Active Directory)
  • Windows Server 2019 (for Active Directory)

Affected Microsoft KBs:

  • Windows Server 2025 KB5094125
  • Windows Server 2022 KB5094128
  • Windows Server 2019 KB5094123

Impact:

Functional:

  • Windows Server 2025 / KB5094125: Threat Prevention agents used by Threat Manager will lose the ability to capture or block Kerberos Authentication activity and capture LDAP Bind activity.
    • Log: resolving HandleTGSRequest failed
    • Log: Couldn’t resolve NlpUserValidate
  • Windows Server 2022 / KB5094128: Threat Prevention agents used by Threat Manager will lose the ability to capture or block Kerberos Authentication activity and capture LDAP Bind activity.
    • Log: Couldn’t resolve I_GetASTicket
  • Windows Server 2019 / KB5094123: Threat Prevention agents used by Threat Manager will lose the ability to capture or block Kerberos Authentication activity and capture LDAP Bind activity.
    • Log: Couldn’t resolve I_GetASTicket

Stability:
No stability impact on any server platforms or domain controllers