AD Kerberos RC4 detection and migration
No content change seen yet. Watched since 5 Oct 17:50 UTC, last read today 20:15 UTC, next check 21 Oct 02:15 UTC. Microsoft's own edits are listed below.
Read the Microsoft source · Link to this observation · My radar
Timeline
From the capture of 5 Oct 17:50 UTC · an earlier observationLegacy capture: table structure or oversized sections are unavailable for extraction
Microsoft's revision log on this page · 19 entries
Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.
- Detect and remediate RC4 usage in KerberosRecommendation
- on or after November 8, 2022RC4 usage in Windows and its risksMilestone
CVE-2022-37966AES-SHA1KB5021131 MSDS-SupportedEncryptionTypesSupportedEncryptionTypesDefaultSupportedEncryptionTypesAES-SHA1SupportedEncryptionTypesAES-SHA1- 1/21/2025Use PowerShell to audit RC4 usageMilestone
List-AccountKeysAES-SHA1AES128-SHA96AES256-SHA96AES128-SHA256 - 1/21/2025Use PowerShell to audit RC4 usageException
Get-KerbEncryptionUsageAES256-SHA96 - The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRecommendation1 condition
AES-SHA1SupportedEncryptionTypesGet-ADObjectDefaultDomainSupportedEncTypes - The processed msDS-SupportedEncryptionTypes value doesn't include the AES-SHA1 bitsRequirement1 condition
SupportedEncryptionTypesDefaultDomainSupportedEncTypesAES-SHA1 - A device doesn't support AES-SHA1Recommendation
AES-SHA1 AES-SHA1- Limit or disable RC4 usageRequirement
SupportedEncryptionTypesNew-PSSessionSupportedEncryptionTypesFullyQualifiedErrorIdSupportedEncryptionTypesAES-SHA1
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
Observed history and review priority
Captured 5 Oct 17:50 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c/legacy.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 9
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 12 Oct 19:50 UTC · 16 candidates
- 6 Oct 17:57 UTC · 20 candidates
- 5 Oct 17:50 UTC · 20 candidates
- 13 Apr 13:40 UTC · 16 candidates
- 6 Feb 15:20 UTC · 16 candidates
- 30 Jan 14:07 UTC · 16 candidates
- 27 Jan 14:06 UTC · 16 candidates
- 27 Jan 14:04 UTC · 16 candidates
- 27 Nov 2025 12:12 UTC · 16 candidates
Microsoft's edits
History on GitHubCommits to the page's source in MicrosoftDocs/windowsserverdocs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 19 Oct 23:40 UTC.
Related public evidence
- Community source · 19 Oct 2026Should You Install Certificate Authority on a Domain Controller? PKI Design Best Practices
- Public source · 19 Oct 2026Retiring NTLM: Frequently asked questions
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
Retained observations
- 12 Oct 19:50 UTC
9 removed passages (about 80 words). The changed wording mentions dates and deadlines, prerequisites. Review the source to confirm the effect.
- 6 Oct 17:57 UTC
Source metadata changed; retained article content is unchanged.
- 5 Oct 17:50 UTC · shown above
What changed
First observed 18 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.