Thousands of VDAs are suddenly “Unregistered.” Ping works, DNS works, but the Kerberos handshake fails. This is the “June 2026 Cliff”—the expiration of industry-standard UEFI signing certificates.

Error: 104, Event ID: 1007, UEFI Status: Certificate Invalid.

The VDA’s hardware identity is rejected by the hypervisor because the underlying OS signing certificate has reached its 10-year hard-coded expiration.

Inject the updated Microsoft/Citrix root certificates into the Golden Image using certutil and updating the VMX/Hyper-V hardware version.

Infrastructure-wide failures are a symptom of reactive maintenance. Don’t wait for the June cliff. [Audit your certificate and compliance readiness today]