What is Script_CVE-2022-37967_fix

Overview

This executable configures Kerberos Privilege Attribute Certificate (PAC) signature enforcement on systems identified as domain controllers.

CVE: CVE-2022-37967
Executable: Script_CVE-2022-37967_fix.exe

Solution

1. Target Detection

• The executable reads the Group Policy machine Distinguished-Name.

• It checks whether the Distinguished-Name contains:

  OU=Domain Controllers

• The configuration is applied only when the system is identified as a domain controller.

2. Configuration Applied

The executable configures the following registry value:

• Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Kdc

• Value name: KrbtgtFullPacSignature

• Data type: REG_DWORD

• Data: 3

The value 3 represents Enforcement mode in the staged Microsoft guidance.

3. What the Executable Does

The executable runs silently. If the Distinguished-Name test identifies the computer as a domain controller, it writes:

KrbtgtFullPacSignature=3

to the KDC service registry key.

4. Verify the Configuration

Verify that the following registry configuration exists on the domain controller:

HKLM\SYSTEM\CurrentControlSet\Services\Kdc 
KrbtgtFullPacSignature    REG_DWORD    0x3

References

Microsoft KB5020805: Kerberos protocol changes for CVE-2022-37967:
Microsoft KB5020805

Microsoft Security Update Guide: CVE-2022-37967:
Microsoft Security Update Guide