diff --git a/NEWS b/NEWS
index ce02c26d7ae784bbb50f12ce0a7f4aecc405eaa1..337203509ab21d331d40709dfa1e04c3d4440fab 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,9 @@
+release/004.059 (2016-03-17)
+
+    [kerberos] Add the new non-production Windows Active Directory domain
+    WINUAT.STANFORD.EDU to /etc/krb5.conf. No other change to
+    /etc/krb5.conf, so this is a completely safe upgrade. (adamhl)
+
 release/004.058 (2016-02-04)
 
     [dns] Remove Livermore-specific DNS (anycast works there now). (akkornel)
diff --git a/templates/kerberos/krb5.conf.erb b/templates/kerberos/krb5.conf.erb
index b3781fc8aba562a5fecfe7042ebb053c4459c093..f5ef1924d7e8d9a0cc74b9841c6931afd04e3c87 100644
--- a/templates/kerberos/krb5.conf.erb
+++ b/templates/kerberos/krb5.conf.erb
@@ -102,10 +102,9 @@ end
         kdc            = rodan.win.stanford.edu:88
         kpasswd_server = mothra.win.stanford.edu
     }
-    MS.STANFORD.EDU = {
-        kdc            = msdc0.ms.stanford.edu:88
-        kdc            = msdc1.ms.stanford.edu:88
-        kpasswd_server = msdc0.ms.stanford.edu
+    WINUAT.STANFORD.EDU = {
+        kdc            = winuatdc1.winuat.stanford.edu:88
+        kpasswd_server = winuatdc1.winuat.stanford.edu
     }
     NT.STANFORD.EDU = {
         kdc            = ntdc2.nt.stanford.edu:88
@@ -203,9 +202,8 @@ end
     windows-new.stanford.edu    = IT.WIN.STANFORD.EDU
     windows.stanford.edu        = IT.WIN.STANFORD.EDU
     workspace.stanford.edu      = IT.WIN.STANFORD.EDU
-    ms.stanford.edu             = MS.STANFORD.EDU
-    .ms.stanford.edu            = MS.STANFORD.EDU
-    mscert1.stanford.edu        = MS.STANFORD.EDU
+    winuat.stanford.edu         = WINUAT.STANFORD.EDU
+    .winuat.stanford.edu        = WINUAT.STANFORD.EDU
     msweb2.stanford.edu         = EX.MS.STANFORD.EDU
     windows-ms.stanford.edu     = EX.MS.STANFORD.EDU
     nt.stanford.edu             = NT.STANFORD.EDU