I installed KB5122882 last night and didn't notice any immediate problems. This morning, users started receiving login prompts when accessing mapped drives and folder redirections, but none of their credentials were accepted. I can still log on locally with a Domain Admin account, but opening the DNS console or running DNS PowerShell commands returns "Access Denied." DNS resolution continues to work, and the domain services appear to be running, so this seems related to authentication or permissions rather than a complete DNS outage. I'm currently rolling back the update and am trying to determine whether anyone else has seen similar Active Directory or DNS issues after installing it.
3 Answers
Collect the DNS, Directory Service, and Security event logs before the rollback completes. If the update changed service permissions or ACL behavior, the logs may be the only useful evidence for troubleshooting or opening a support case. DNS still resolving while the management console returns Access Denied suggests a permissions or service-account problem rather than DNS being completely down.
There have also been reports of older Windows Server systems having Active Directory Domain Services startup problems after updates, but that alone doesn’t confirm the same cause here. Check whether the affected servers received the identical package and compare their Directory Service and System event logs before concluding that the update is responsible.
One older server was unable to start Active Directory Domain Services this morning, although it isn’t clear yet whether it received the same update. The timing makes it worth comparing the installed packages and event logs.
A rollback is a reasonable first test if the problems began immediately after the update. Compare the results after restarting the affected services or rebooting, and verify whether mapped-drive authentication and DNS administration return to normal. Keep in mind that another underlying permissions or authentication issue could produce the same symptoms, so preserve the logs before changing anything further.
The DNS logs were empty after the update. The Security log showed multiple AD- and DNS-related services failing with Access Denied, so I’m saving those entries before the rollback finishes.