AD Kerberos RC4 detection and migration
Timelines and exceptionsTimeline
From the capture of 5 Oct 17:50 UTC · an earlier observationLegacy capture: table structure or oversized sections are unavailable for extraction
Microsoft's revision log on this page · 19 entries
Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.
- Detect and remediate RC4 usage in KerberosRecommendation
- on or after November 8, 2022RC4 usage in Windows and its risksMilestone
CVE-2022-37966AES-SHA1KB5021131 MSDS-SupportedEncryptionTypesSupportedEncryptionTypesDefaultSupportedEncryptionTypesAES-SHA1SupportedEncryptionTypesAES-SHA1- 1/21/2025Use PowerShell to audit RC4 usageMilestone
List-AccountKeysAES-SHA1AES128-SHA96AES256-SHA96AES128-SHA256 - 1/21/2025Use PowerShell to audit RC4 usageException
Get-KerbEncryptionUsageAES256-SHA96 - The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRecommendation1 condition
AES-SHA1SupportedEncryptionTypesGet-ADObjectDefaultDomainSupportedEncTypes - The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRequirement1 condition
SupportedEncryptionTypesDefaultDomainSupportedEncTypesAES-SHA1 - A device doesn't support AES-SHA1Recommendation
AES-SHA1 AES-SHA1- Limit or disable RC4 usageRequirement
SupportedEncryptionTypesNew-PSSessionSupportedEncryptionTypesFullyQualifiedErrorIdSupportedEncryptionTypesAES-SHA1
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
Observed history and review priority
Captured 5 Oct 17:50 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c/legacy.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 9
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 12 Oct 19:50 UTC · 16 candidates
- 6 Oct 17:57 UTC · 20 candidates
- 5 Oct 17:50 UTC · 20 candidates
- 13 Apr 13:40 UTC · 16 candidates
- 6 Feb 15:20 UTC · 16 candidates
- 30 Jan 14:07 UTC · 16 candidates
- 27 Jan 14:06 UTC · 16 candidates
- 27 Jan 14:04 UTC · 16 candidates
- 27 Nov 2025 12:12 UTC · 16 candidates