Affected Products and Versions 

Symptoms 

After applying Windows Update KB5065426 (or later), affected environments may observe: 

• RDP connections from one VDA to another VDA provisioned from the same golden image fail. 

• SMB file sharing between VDAs provisioned from the same golden image is blocked. 

• Printer sharing between VDAs provisioned from the same golden image is blocked. 

• Any other Kerberos or NTLM-based machine-to-machine communication between VDAs from the same golden image fails. 

• The following event is logged in the System event log on the target machine: 
   
  LsaSrv Event ID 6167: There is a partial mismatch in the machine ID. This indicates that the ticket has either been manipulated or it belongs to a different boot session. Failing authentication. 

"Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items." 

Root Cause 

Citrix MCS and PVS provision VDA machines by cloning from a common master (golden) image. These machines share the same local machine SID. 

Microsoft's August and September 2025 Windows Updates (KB5064081 and KB5065426) introduced security hardening to loopback authentication. Specifically: 

• Before the update: Windows generated a new machine ID on every boot. Authentication between cloned machines succeeded because only the per-boot component of the machine ID was checked. 

• After the update: Windows now persists part of the machine ID across reboots (a cross-boot component). When two machines share the same cross-boot machine ID component — as is the case with cloned VDAs — but have different per-boot components, Windows detects a partial machine ID mismatch and blocks the authentication attempt. (Hardening administrative actions: What IT pros need to know - Windows IT Pro Blog) 

As Microsoft has stated in their official blog: "This is by design and should be seen as a security signal, not a code defect." 

This means any Kerberos or NTLM-based machine-to-machine communication — RDP, file sharing, printer sharing — is blocked between VDAs cloned from the same golden image. 

Note: This behavior applies to Windows 11 version 24H2 and later, and Windows Server 2025. Earlier Windows versions are not affected by this specific hardening change. 

Resolution 

There are two options depending on your environment's requirements. 

Option 1 — Recommended: Use Separate Golden Images for VDAs That Require Machine-to-Machine Communication 

This is the recommended approach. It fully resolves the issue with no security trade-offs. 

1. Identify VDAs that need to Kerberos-authenticate with each other (for example, VDAs that use one VDA as a file server or print server for other VDAs).
   
   
2. Place these VDAs into separate machine catalogs, each provisioned from a different golden image.
   
   
3. Apply Microsoft's security updates (KB5065426 and later) normally. With unique SIDs across catalogs, authentication between machines in different catalogs will succeed. 

This approach aligns with Microsoft's deployment guidance and eliminates the duplicate SID condition entirely. 

Option 2 — Temporary Workaround: Enable Audit Mode (Citrix Support Required) 

This option applies only if it is not feasible to restructure your machine catalogs as described in Option 1, and your use case specifically requires Kerberos authentication between VDAs sharing the same golden image. 

Please open a support case with Citrix Support (refer to CVADHELP-29535 when opening the Citrix support case). Citrix Support will work with you to assess your environment and refer you to Microsoft Support to obtain the necessary steps to disable the authentication block for your environment. 

Citrix Long-Term Solution 

Citrix is actively working on an engineering solution to eliminate duplicate local SIDs on VDAs provisioned from the same golden image. We will provide updates on the timeline and availability through our standard communication channels and KB articles.

Following the installation of Microsoft's September 2025 security update (KB5065426), Citrix customers may experience failures in RDP, file sharing, printer sharing, and other machine-to-machine communications between VDAs provisioned from the same golden image using Machine Creation Services (MCS) or Provisioning Services (PVS). 

This issue arises because Citrix's cloning-based provisioning model produces VDAs that share duplicate local Security Identifiers (SIDs), and Microsoft's update introduces authentication hardening that detects and blocks communications between machines with duplicate SIDs. 

This article describes the symptoms, root cause, and available options to mitigate the issue.

References 

• Microsoft Tech Community Blog: Hardening administrative actions: What IT pros need to know (April 9, 2026, by Dashmeet Ajmani) 

• KB5065426: Windows Server 2025 — September 9, 2025 Security Update (OS Build 26100.6584) 

• KB5064081: Windows 11 — August 29, 2025 Preview Update (OS Build 26100.5074) 

• KB5068222: Strengthening administrator protection and Kerberos authentication 

• KB5070568 Kerberos and NTLM authentication failures due to duplicate SIDs (published October 21, 2025) 

• KB5082063: Windows Update (April 14, 2026) — Replaced KIR group policy setting with registry key workaround