After patches, some users report being prompted for login on intranet links; which root cause is most likely?

After patches, some users report being prompted for login on intranet links; which root cause is most likely?

• A. SSO issues
• B. Password expiration
• C. Certificate expiration
• D. Account lockout

Answer: (A)

The main idea here is that the intranet resources rely on Single Sign-On to authenticate users automatically. When patches cause users to be prompted for credentials again, it usually means the authentication handshake (Kerberos/NTLM or SAML) between the client and the SSO provider is breaking. This can happen if patching alters browser security settings, certificate trust, time synchronization, SPN/trust relationships, or the IdP/SSO service itself. Because the token or assertion isn’t issued or accepted, the system falls back to asking for manual login. That’s why the most likely root cause is an SSO issue. Password expiration would trigger a password change independently of SSO, certificate expiration would typically produce a certificate warning or TLS error rather than a simple login prompt, and an account lockout would present access denial after repeated failures rather than a fresh login prompt on intranet links.

The main idea here is that the intranet resources rely on Single Sign-On to authenticate users automatically. When patches cause users to be prompted for credentials again, it usually means the authentication handshake (Kerberos/NTLM or SAML) between the client and the SSO provider is breaking. This can happen if patching alters browser security settings, certificate trust, time synchronization, SPN/trust relationships, or the IdP/SSO service itself. Because the token or assertion isn’t issued or accepted, the system falls back to asking for manual login.

That’s why the most likely root cause is an SSO issue. Password expiration would trigger a password change independently of SSO, certificate expiration would typically produce a certificate warning or TLS error rather than a simple login prompt, and an account lockout would present access denial after repeated failures rather than a fresh login prompt on intranet links.