Kerberos authentication
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit c01844d · +5 −2 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.assetid: 646c6309-e865-4be2-b415-44dd125af5c2
66
ms.author: mosagie
77
author: meaghanlewis
8
−manager: mtillman
9
−ms.date: 04/17/2025
8
+ms.date: 07/14/2025
109
---
1110
# Kerberos authentication overview in Windows Server
1211
⋯ 26 unchanged lines
3938
### Mutual authentication
4039
4140
By using the Kerberos protocol, a party at either end of a network connection can verify that the party on the other end is the entity it claims to be. NTLM does not enable clients to verify a server's identity or enable one server to verify the identity of another. NTLM authentication was designed for a network environment in which servers were assumed to be genuine. The Kerberos protocol makes no such assumption.
41
+
42
+## Encryption types
43
+
44
+Beginning with Windows Server 2025, Kerberos no longer honors the legacy registry key `REG_DWORD SupportedEncryptionTypes` found in the path **HKEY_LOCAL_MACHINE\CurrentControlSet\Control\Lsa\Kerberos\Parameters**. Microsoft recommends using group policy instead. To learn more about the group policy settings, see [Network security: Configure encryption types allowed for Kerberos](https://learn.microsoft.com/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos).
4245
4346
## Related content
4447
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:52 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.