AD Kerberos RC4 detection and migration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit b67e8b1 · +2 −1 lines · also on GitHub
⋯ 33 unchanged lines
3434
The Kerberos RC4 default encryption type can be abused to carry out an attack method known as *Kerberoasting*, which targets service tickets in Microsoft Active Directory. In Kerberoasting, attackers capture these tickets and crack their encryption offline to steal user credentials, potentially compromising the security of the entire network. Changing the encryption type of Kerberos to use AES-SHA1 by default instead of RC4 helps protect customers against this attack.
3535
3636
> [!IMPORTANT]
37
−> Microsoft plans to disable RC4 use as the default encryption type for Active Directory domain controllers by the end of the second quarter of 2026.
37
+> Microsoft plans to disable RC4 use as the assumed supported encryption type for Active Directory domain controllers by the end of the second quarter of 2026. For additional information please see [How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833
38
+](https://support.microsoft.com/topic/how-to-manage-kerberos-kdc-usage-of-rc4-for-service-account-ticket-issuance-changes-related-to-cve-2026-20833-1ebcda33-720a-4da8-93c1-b0496e1910dc)
3839
3940
## Prerequisites
4041
⋯ 349 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.