ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 257/260 feeds/APIs · 416/439 docs · checked 21:54 UTC Customize Public modeDiscuss ChangeIntel on Discord

Kerberos RC4 ticket issuance changes

Timelines and exceptions · All guidance changes

Windows Server · Official Microsoft guidance

No content change seen yet. Watched since 12 Oct 19:19 UTC, last read 19 Oct 23:40 UTC, next check today 23:40 UTC.

Read the Microsoft source · Link to this observation · My radar

Timeline

From the capture of 12 Oct 19:19 UTC
Published timing needs confirmation July 2026 most recent · 2 months ago
  1. Audit / monitoron or after 13 Jan 2026 Published timing is qualified; effectiveness is not confirmed.
  2. Enforced by defaulton or after April 2026 Published timing is qualified; effectiveness is not confirmed.
  3. Enforced by defaultafter 14 Apr 2026 Published timing is qualified; effectiveness is not confirmed.
  4. Enforcedafter July 2026 Published timing is qualified; effectiveness is not confirmed.
  1. 9 months agoon or afterafterAudit / monitor · unconfirmed
  2. 5 months agomonth windowon or afterafterEnforced by default · unconfirmed
    • Take actionMilestoneExceptionRecommendation1 condition
      SupportedEncryptionTypes
  3. 6 months agoafterEnforced by default · unconfirmed
    • SummaryMilestoneException2 conditions
      DefaultDomainSupportedEncTypes
      To mitigate this vulnerability, Windows updates released on and after April 14, 2026, change the Kerberos Key Distribution Center (KDC) default value for DefaultDomainSupportedEncTypes, unless…
    • April 14, 2026 - Enforcement Phase with manual rollbackMilestoneException1 condition
      DefaultDomainSupportedEncTypesAES-SHA1SupportedEncryptionTypes
  4. 2 months agomonth windowafterin or afterEnforced · unconfirmed

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

Requirements, exceptions and scope

  • SummaryScope1 condition1 passage
    DefaultDomainSupportedEncTypes
  • Take actionRequirementRecommendation1 condition2 passages
    CVE-2026-20833
  • Step 2: MONITORExceptionRecommendation1 condition2 passages
    AES-SHA1
  • RC4DefaultDisablementPhaseRequirement2 passages
  • Event ID: 201Exception2 conditions2 passages
    SupportedEncryptionTypesDefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • Event ID: 202Exception1 condition1 passage
    SupportedEncryptionTypesDefaultDomainSupportedEncTypes
  • Event ID: 203Exception2 conditions2 passages
    SupportedEncryptionTypesDefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • Event ID: 204Exception1 condition1 passage
    SupportedEncryptionTypesDefaultDomainSupportedEncTypes
  • Event ID: 205Exception1 condition1 passage
    AES-SHA1RC4DefaultDisablementPhase
  • Event ID: 206Exception2 conditions2 passages
    SupportedEncryptionTypesAES-SHA1DefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • Event ID: 207Exception2 conditions2 passages
    SupportedEncryptionTypesAES-SHA1DefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • Event ID: 208Exception2 conditions2 passages
    SupportedEncryptionTypesAES-SHA1DefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • Event ID: 209Exception2 conditions2 passages
    SupportedEncryptionTypesAES-SHA1DefaultDomainSupportedEncTypesRC4DefaultDisablementPhase
  • NoteException2 conditions2 passages
    AES-SHA1SupportedEncryptionTypes
  • Frequently asked questions (FAQ)ExceptionRecommendation1 condition2 passages
    AES-SHA1
Microsoft's revision log on this page · 1 entry

Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.

  • April 14, 2026 · April 2026 · after April 14, 2026 · February 10, 2026 · Starting April 2026 · on or after April 2026 · after January 13, 2026Change logMilestoneException3 conditions
    DefaultDomainSupportedEncTypesRC4DefaultDisablementPhaseCVE-2026-20833

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

  1. Microsoft logged a correction Change logMicrosoft's change log
Observed history and review priority

Captured 12 Oct 19:19 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Extracted assertions require review · Applicability or exceptions require review

0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Suggested by a shared curated topic and product; not a verified connection (6 items)

What changed

First observed 18 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 21:54 UTC · 257 of 260 readable · 255 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.