AD Kerberos RC4 detection and migration

1. Audit / monitorJanuary 2025 Published timing is qualified; effectiveness is not confirmed.

1. 8 Nov 2022 3 years agoon or after
   • RC4 usage in Windows and its risksMilestone
     CVE-2022-37966AES-SHA1KB5021131

     In response to…

2. January 2025 20 months agomonth windowupdate release · Patch Tuesday 14 Jan 2025Audit / monitor · unconfirmed
   • Audit RC4 usageException1 condition

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• AES-SHA18 Nov 2022
• DefaultDomainSupportedEncTypes
• DefaultSupportedEncryptionTypes
• Get-KerbEncryptionUsage
• MSDS-SupportedEncryptionTypes
• New-PSSession
• SupportedEncryptionTypes

Requirements, exceptions and scope

• GuidanceRecommendation1 passage

  At a high level, IT administrators should take the following actions to prepare for the default changes to Kerberos support for RC4:…

• Event Log fields for RC4 usageException7 conditions3 passages
  MSDS-SupportedEncryptionTypesSupportedEncryptionTypesDefaultSupportedEncryptionTypesAES-SHA1
• Use PowerShell to audit RC4 usageException1 passage
  Get-KerbEncryptionUsage
• The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRequirementRecommendation2 conditions2 passages
  AES-SHA1SupportedEncryptionTypesDefaultDomainSupportedEncTypes
• A device doesn't support AES-SHA1Recommendation1 passage
  AES-SHA1
• Limit or disable RC4 usageRequirementException2 conditions3 passages
  AES-SHA1
• Identify authentication failures after disabling RC4Exception3 conditions3 passages
  SupportedEncryptionTypesNew-PSSessionAES-SHA1

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.