1

The July 2025 Patch Tuesday release of KB5062572 included this update:

[Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain controllers will no longer allow anonymous clients to invoke some RPC requests through the Netlogon RPC server. These requests are typically related to domain controller location. Certain file and print service software can be affected, including Samba. If your organization uses Samba, please refer to the Samba release notes. ​​​​​​

I am curious if there are any Synology NAS > Shared Folder users out there who have patched their 2022 Domain Controllers with KB5062572 and either experienced no issues, or had problems with SMB and file shares in general.

The June 2025 Patch Tuesday releases dealt us a blow in the DHCP department, the likes of which crashed out RRAS entirely. A month later, and a move to OpenVPN, we’re finally stable once again and while I would like to push KB5062572 to get the benefit of the other gem the release (ref’d below), I have little appetite for another potential disruption of file share access - and the users have even less interest in another outage :slight_smile:

[DHCP Server (known issue] Fixed: An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients.

We use Windows 11 24H2 heavily for our end users; the past ~year has been one mitigation after another that makes one dream of retirement!

I welcome any experiences you’d be willing to share with the July 2025 Patch Tuesday releases. Thank you!

5 Spice ups
2

It was a non-event, considering the cluster it could have been…there were major changes to how Domain Controllers handle Kerberos that went from a previous passive state to fully enabled. I’m guessing there was enough announcement ahead of time to allow admins the chance to fix it before it broke but it was still a pretty major change for a monthly release!

3 Spice ups
3

You’re talking about a single patch and a specific NAS, it’s going to be hard to tell if there are any known issues without a specific model.

That said, I don’t expect you will see any issues.

1 Spice up
4

Thanks for response @Rod-IT

We have two devices, one Synology NAS DS1819+ and one Synology NAS DS1823xs+. Each with a Linux OS that use SMB for file sharing. I do not anticipate any issues as the DNS and Domain settings interact with our AD for auth but curious in general how non-Windows systems may have been impacted by the RPC hardening in this latest release.

1 Spice up
5

So you run a VM on top of the NAS just for sharing, if yes, then the NAS itself plays no part, it would be the Linux VM you’d want to check, though I wouldn’t understand why you don’t just connect to the NAS itself for shares.

Anyway:

--------- Response from AI ---------

If your Synology NAS is:

  • Joined to a Windows domain, or
  • Using SMB/CIFS file sharing with Active Directory authentication, or
  • Interfacing with Samba services,

Then the Netlogon protocol hardening in KB5062572 could affect authentication or connectivity, especially if:

  • You’re using older Samba versions.
  • Anonymous RPC requests are part of your setup.

In such cases, you should:

  • Update Samba to the latest version.
  • Review Samba’s release notes for compatibility with hardened Netlogon protocols.

If your Linux NAS or server:

  • Uses Samba to serve SMB shares,
  • Is joined to an AD domain, and
  • Relies on Winbind or idmap information stored in AD,

Then users may lose access to SMB shares after applying KB5062572 on Windows Server 2022 or 2025 systems

The short version is to ensure your target shares are up to date first.

1 Spice up
6

No, but I appreciate that you took the time to think more about my question. To clarify, the Synology NAS’s run Linux OS’s - that’s all. And because of the Linux OS relationship with Samba services, I just am lightly pausing the 2022 DC patches for a while as I consider what barriers those NAS file shares might now encounter. And the AI response you shared I also found those same elements. Our NAS’s are domain joined.

1 Spice up
7

What’s the purpose of the NAS’s if they’re running a server directly on them, instead of being VM Host Storage? And if you were to use the NAS’s for VM Host Storage, I would recommend using iSCSI instead of SMB/Samba for this very reason.

Actually, you could probably still switch to iSCSI…

8

This is what I thought you meant, but they don’t, they run DSM which is based on Linux, the underlying OS isn’t directly Linux itself.

That’s why I was checking.

1 Spice up
9

Yes, DSM - and they are at the latest values - appreciate your added insight. I don’t have any restrictive GPOs and don’t enforce SMB Signing, for DCs, this GPO is enabled: Microsoft network server: Digitally sign communications (if client agrees).

1 Spice up