What and why:
Microsoft introduced additional security requirements for LDAP authentication on Active Directory domain controllers starting with the October 13, 2026, Windows security updates. These changes require Kerberos service tickets used for LDAP authentication to match the LDAP service principal name SPNSPN registered on the target domain controller. This helps strengthen authentication security by preventing tickets intended for other services from being used to authenticate to LDAP.
Rollout schedule:
This change was introduced with Windows security updates released on October 13, 2026, and is included in subsequent updates.
Impact on your organization:
Following this security change, affected NetApp configurations might experience:
- Issues accessing SMB shares and disruptions to applications that depend on these shares.
- "Invalid credentials" errors when creating new SMB volumes or performing certain LDAP operations.
- Who is affected by these issues: Azure NetApp Files and NetApp ONTAP configurations that connect to Active Directory LDAP with LDAP client session security set to none.
- Platforms/services: Windows Server 2025, 2022, 2019, 2016, 2012 ESU and 2012 R2 ESU; Azure NetApp Files and NetApp ONTAP.
Action required / recommendations:
NetApp is working to provide a resolution that will allow you to install Windows security updates without disrupting access to affected Azure NetApp Files resources. Consult the
NetApp Knowledge Base for the latest information.
Additional information:
Compliance considerations:
The change strengthens LDAP authentication requirements but can affect access to SMB shares in certain configurations. Review additional security requirements as appropriate for your organization.