Microsoft’s long-running Kerberos hardening campaign is entering its final, non-reversible phase: the temporary registry workarounds that allowed administrators to keep weak certificate mappings and “Compatibility” behavior will be removed with the September 2025 servicing wave, forcing everyone...