Smart Card Users Unable to Authenticate After Windows Update (2010 Printer Models)

Single-Function: C748, C792, C925, and C950

Multifunction: X548, X746, X748, X792, X925, X950, X952, and X954

Smart card users are unable to authenticate after installing Windows updates containing protections for CVE-2020-33764 on supported Active Directory domain controllers.

Edit the krb5.conf file to remove "pkinit_win2k = yes"

1. View the Current Kerberos file: Settings > Security > Security Setup > Kerberos 5 > View > Save the Kerberos File onto Notepad or WordPad.



2. Replace the encryption lines with the following:

   • default_etypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5 des-cbc-md5 des-cbc-crc

   • default_etypes_des = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5 des-cbc-md5 des-cbc-crc



3. Remove the "pkinit_win2k = yes" line from the file.



4. Save the File as "AES256_KerberosFile.conf".



5. Upload to device: Settings > Security > Security Setup > Kerberos 5 > Import Kerberos File.



6. Change the PKI Authentication App or Smart Card Authentication Application to use Device Kerberos Setup.
   Note: If the step is not followed, the Kerberos file will be reset to default settings and the changes applied will be lost.

Have the following available when calling Lexmark Technical Support;

• Printer model(s)

• Printer serial number

LEGACY ID: SO9059