On October 13, Microsoft released KB updates that conflict with the Active Directory (AD) Module in the Netwrix Activity Monitor product.
If these KBs are applied before updating the AD Module, certain LDAP Bind, Kerberos, and NTLM events will no longer be captured.
Netwrix recommends delaying deployment of these KBs if your organization relies on these event types. The Netwrix development and QA teams are working on an updated AD Module compatible with these KBs and will send another notice when it is available.
Important Details
If your organization does not use Netwrix Activity Monitor for the following Active Directory activity event collection, or such events are not deemed important, you may elect to deploy the following Microsoft KBs in advance of the updated AD Module.
No other aspect of Activity Monitor operation is impacted by the October 13, 2026, KBs beyond what is described below. There is no adverse impact to Windows Server 2025, 2022, 2019, or 2016 domain controllers if the KBs are deployed without updating the AD Module.
Event Types Affected:
LDAP Bind, Kerberos, NTLM
Severity:
Medium
Affected Product: Netwrix Activity Monitor for Active Directory
Affected Systems:
- Windows Server 2025
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
Affected Microsoft KBs:
- KB5126646
- KB5126655
- KB5126651
- KB5126868
Impact:
Functional:
Windows Server 2025 / KB5126646: LDAP Bind events will not be collected
Log messages observed:
Failed hook: LDAP_CONN::HookBindRequest
Windows Server 2022 / KB5126655: LDAP Bind, Kerberos events will not be collected
Log messages observed:
Failed hook: LDAP_CONN::HookBindRequest
Failed hook: I_GetASTicket
Windows Server 2019 / KB5126651: LDAP Bind, Kerberos, NTLM events will not be collected
Log messages observed:
Failed hook: LDAP_CONN::HookBindRequest
Failed hook: I_GetASTicket
Failed hook: NlpLogonSamLogon (New)
Windows Server 2016 / KB5126868: Kerberos, NTLM events will not be collected
Log messages observed:
Failed hook: I_GetASTicket
Failed hook: NlpLogonSamLogon (New)
Stability:
No stability impact has been observed on Windows Server 2025, 2022, 2019, or 2016 domain controllers.
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Activity Monitor > Activity Monitor Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Activity Monitor > Activity Monitor Ideas |
| If you have something cool to show… | Show everyone what you built: Activity Monitor > Activity Monitor Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!