ConfigMgr MSRC article draft

Author: bhuney

memdocs/configmgr/hotfix/2207/15498768.md

@@ -0,0 +1,73 @@
+---
+title: NTLM connection fallback update for Microsoft Endpoint Configuration Manager
+titleSuffix: Configuration Manager
+description: NTLM connection fallback update for Configuration Manager
+ms.date: 09/16/2022
+ms.prod: configuration-manager
+ms.technology: configmgr-core
+ms.topic: reference
+ms.assetid: 3c93a332-e818-46fe-860f-cbebf4dd9ab3
+author: bhuney
+ms.author: brianhun
+manager: dougeby
+---
+# NTLM connection fallback update for Microsoft Endpoint Configuration Manager
+
+*Applies to: Configuration Manager (current branch, versions 2103, 2107, 2111, 2203, 2207)*
+
+## Summary of KB15498768
+Disabling the **Allow connection fallback to NTLM** option in *Client Push Installation Properties* is not honored under either of the following conditions:
+- If there are Kerberos authentication failures the client push account will attempt an NTLM connection instead.
+- The site server computer account will attempt a connection using NTLM if all defined client push installation accounts fail to connect.
+
+This update prevents any attempt at NTLM authentication for client push installation when the **Allow connection fallback to NTLM** option is disabled.
+
+Installation of this update resolves the following security issue:
+- [CVE-2022-37972](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37972)
+
+Beginning with Configuration Manager current branch, version 2207, the **Allow connection fallback to NTLM** option is *disabled* by default on new site installations.
+It is recommended to disable this option in existing environments where possible to increase security.
+
+Refer to the following documents for more detail on client and NTLM security.
+- [Security and privacy for Configuration Manager clients](https://docs.microsoft.com/mem/configmgr/core/clients/deploy/plan/security-and-privacy-for-clients#security-guidance-for-clients)
+- [KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services](https://support.microsoft.com/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429)
+- [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers)
+ 
+## Update information for Microsoft Endpoint Configuration Manager, versions 2103-2207
+An update to resolve this issue is available in the **Updates and Servicing** node of the Configuration Manager console for environments that installed versions 2103-2203. 
+
+#### Update replacement information
+This update does not replace any previously released updates.
+
+#### Restart information
+For Configuration Manager versions 2107 and higher, this update does not require a computer restart or a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset) after installation.
+
+Configuration Manager version 2103 will require a site reset after update installation.
+
+### Additional installation information
+After you install this update on a primary site, pre-existing secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** >  **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. Configurations and settings for the secondary site are not affected by this reinstallation. The new, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.
+
+Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:
+   ```sql
+   select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')
+   ```
+If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.
+
+If the value 0 is returned, the site has not installed all the fixes that are applied to the primary site, and you should use the **Recover Secondary Site** option to update the secondary site.
+
+## Version information
+No major components are updated with this release.
+
+## File information
+File information is available in the following version-specific file lists (KB15498768_FileList.txt):
+- [Configuration Manager 2103](https://aka.ms/KB15498768_2103_FileList)
+- [Configuration Manager 2107](https://aka.ms/KB15498768_2107_FileList)
+- [Configuration Manager 2111](https://aka.ms/KB15498768_2111_FileList)
+- [Configuration Manager 2203](https://aka.ms/KB15498768_2203_FileList)
+- [Configuration Manager 2207](https://aka.ms/KB15498768_2207_FileList)
+
+## Release history
+- September 16, 2022: Initial hotfix release
+
+## References
+[Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md)