Strongcertificatebindingenforcement: !!link!!
An attacker with a valid certificate (even one belonging to a different user) could alter the Subject or SAN before sending it to the DC. If the weak mapping didn't enforce a cryptographic check, the DC might accept the forged identity.
Ensure you are on Level 1. Then, enable Audit Mode for Certificate Mapping via Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policies > Account Logon > Audit Kerberos Authentication Service
| Value | Mode | Behavior | | :--- | :--- | :--- | | | Disabled | The DC uses legacy weak mappings (AltSecID) only. Highly insecure. | | 1 | Compat (Legacy) | The DC tries strong binding first. If that fails, it falls back to weak mappings. This is the default for older domain functional levels. | | 2 | Enforced | The DC requires strong binding. Weak mappings are ignored. This is the modern security standard. | Why "Compat" Mode (1) is Dangerous Most environments currently sit at Level 1 (Compat) . At first glance, this seems safe—it tries to be secure. strongcertificatebindingenforcement
This led to the infamous scenario, where an attacker could impersonate a privileged user simply by presenting a certificate with a spoofed SAN. The Fix: Strong Certificate Binding Enter Strong Certificate Binding .
If the crypto doesn’t match the claimed identity, authentication fails. Microsoft introduced the StrongCertificateBindingEnforcement registry key (located under HKLM\SYSTEM\CurrentControlSet\Services\Kdc ) to control this behavior. It accepts three values: An attacker with a valid certificate (even one
Look for (KDC_ERR_CERTIFICATE_MISMATCH) and Event ID 41 (Weak mapping fallback). These events tell you exactly which accounts will break when you enforce strong binding.
In security, "fallback to insecure" is just "insecure with extra steps." Before you flip the switch to Level 2 across all your DCs, you need to audit your environment. Switching to Enforced will break authentication for any user or device that relies on weak certificate mapping. Then, enable Audit Mode for Certificate Mapping via
For years, most admins ignored it. But in 2024/2025, ignoring this setting is a security risk you cannot afford to take.