This is the first entry in my weekly Microsoft infrastructure bulletin. The goal is simple: to gather, in one place, the developments on the AD DS, GPO, certificate services and SCCM/ConfigMgr side that actually require action this week — together with their technical impact, operational risk and the checks you should run.
When I validate a patch, the test I value most is confirming that a user or a device can complete its day-to-day work end to end. Two developments this week show exactly why that approach matters. Microsoft released a fix for an issue that blocks client enrollment over the cloud in Configuration Manager 2603, and NetApp documented which workflows are affected by the LDAP error seen on some Active Directory connections after the October Windows Server updates.
1. Verify client enrollment over CMG in ConfigMgr 2603
When update rollup KB39169655 is installed on Configuration Manager 2603, devices that aren’t Microsoft Entra joined and that bulk-register through a Cloud Management Gateway (CMG) may fail to obtain their Configuration Manager-issued client authentication token. Because the management point can’t verify these devices’ registration token, client communication breaks. Microsoft states that devices using Microsoft Entra authentication aren’t affected; the impact on other CMG scenarios for non-Entra-joined devices is marked as "possible", i.e. outside the confirmed scope.
Microsoft documents this as a functional fix and doesn’t assign a CVE. The fix, KB40345593, applies only to 2603 sites that have KB39169655 installed.
In this scenario, the first place I look is the CCM_STS.log file on the management point, where I search for the mpisapiclr assembly mismatch and the 0x80131040 error. If the version and prerequisite match, I install KB40345593 from the Updates and Servicing node during a maintenance window. According to Microsoft, no computer restart is required, but a site reset is needed after installation, and preexisting secondary sites must be updated manually via Recover Secondary Site. As the final step, I register a non-Entra-joined test device through the CMG and confirm that it receives its token and that client communication continues.
2. Check the NetApp LDAP / SMB access issue after the October updates
The Windows security updates released on or after October 13 began verifying that the Kerberos ticket presented to the domain controller’s LDAP endpoint actually belongs to the LDAP service. In affected NetApp configurations where the LDAP client session security is none, the ticket obtained for the controller’s CIFS SPN was being used on the LDAP bind. After the update, the DC rejects this ticket because it doesn’t match the LDAP SPN, and the connection fails with an Invalid credentials error.
The impact ranges from disrupted user and group lookups to loss of SMB share access, and even the inability to create new SMB volumes. If a business-critical share is down, this becomes an urgent issue. The sources here document a compatibility/configuration problem; I haven’t confirmed any finding of active exploitation.
On a self-managed ONTAP environment, I check the session-security-for-ad-ldap value on the relevant SVMs. If none is in use, I validate the vendor-recommended sign or seal setting on a pilot SVM first. I make sure my test includes an LDAP query, a share whose authorization depends on group membership, and the SMB path the application actually uses. If users reach the drive via GPO, I check the policy result with gpresult /h and separately measure file access by opening the UNC path directly. If you use Azure NetApp Files, check the LDAP signing setting on the AD connection and the forward/reverse DNS records of the DCs you select. Microsoft’s documented temporary LdapSPNVerificationLevel=0 registry option disables SPN verification (that is, this protection); if you must use it, limit it to the affected DCs only and plan a return to the default value of 1.
Quick checklist
- If you have a critical NetApp share, verify UNC access and group-membership-based authorization from a test client against a patched DC.
- If you run ConfigMgr 2603 + KB39169655, test non-Entra-joined device enrollment over the CMG; if it fails, plan a maintenance window for KB40345593 that includes a site reset and secondary-site updates.
- To prepare for the next patch pilot, record DC version, build and installed KBs; capture comparable test results for GPO processing, certificate enrollment and ConfigMgr client registration.
Related posts
Sources
- Microsoft Learn — ConfigMgr 2603 KB40345593
- Microsoft Support — NetApp SMB access issue (October 2026)
- NetApp — CONTAP-821088
- Microsoft Learn — Azure NetApp Files SMB FAQ
Note: This bulletin is informational; validate any changes in a test/pilot environment before applying them in your own environment.
