AD Kerberos RC4 detection and migration

Source history: extracted from the page's source file at a commit; shared includes are not expanded

1. Audit / monitorJanuary 2025 Published timing is qualified; effectiveness is not confirmed.

1. 8 Nov 2022 3 years agoon or after
   • RC4 usage in Windows and its risksMilestone
     CVE-2022-37966AES-SHA1KB5021131
2. January 2025 20 months agomonth windowupdate release · Patch Tuesday 14 Jan 2025Audit / monitor · unconfirmed
   • Audit RC4 usageException1 condition

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• AES-SHA18 Nov 2022
• DefaultDomainSupportedEncTypes
• DefaultSupportedEncryptionTypes
• Get-KerbEncryptionUsage
• MSDS-SupportedEncryptionTypes
• New-PSSession
• SupportedEncryptionTypes

Requirements, exceptions and scope

• Detect and remediate RC4 usage in KerberosRecommendation1 passage
• Event Log fields for RC4 usageException7 conditions3 passages
  MSDS-SupportedEncryptionTypesSupportedEncryptionTypesDefaultSupportedEncryptionTypesAES-SHA1
• Use PowerShell to audit RC4 usageException1 passage
  Get-KerbEncryptionUsage
• The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRequirementRecommendation2 conditions2 passages
  AES-SHA1SupportedEncryptionTypesDefaultDomainSupportedEncTypes
• A device doesn't support AES-SHA1Recommendation1 passage
  AES-SHA1
• Limit or disable RC4 usageRequirementException2 conditions3 passages
  AES-SHA1
• Identify authentication failures after disabling RC4Exception3 conditions3 passages
  SupportedEncryptionTypesNew-PSSessionAES-SHA1

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.