Kerberos authentication destroyed, entire domains down

November’s Patch Tuesday broke Kerberos authentication on domain controllers — the backbone of Windows enterprise authentication. Domain sign-ins failed. Group Managed Service Accounts stopped working. Active Directory Federation Services went down. Remote Desktop connections refused. File sharing broke. Entire enterprise domains became effectively unusable overnight. Kerberos is the authentication protocol that everything in a Windows enterprise depends on, and Microsoft broke it in a security update. The emergency fix KB5021656 arrived nine days later. Nine days of enterprises unable to authenticate their users.