{"id":7391,"date":"2024-10-05T07:11:31","date_gmt":"2024-10-05T07:11:31","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=7391"},"modified":"2026-04-14T03:17:42","modified_gmt":"2026-04-14T03:17:42","slug":"disable-rc4hmac-kerberos","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/disable-rc4hmac-kerberos","title":{"rendered":"Disable Rc4Hmac Kerberos"},"content":{"rendered":"\n<p>Check Useage <\/p>\n\n\n\n<p><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/security\/kerberos\/detect-remediate-rc4-kerberos\">Detect and Remediate RC4 Usage in Kerberos | Microsoft Learn<\/a><\/p>\n\n\n\n<p>Set all Users to use Kerboros AES128\\256<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># 0x18 = AES128 + AES256 only (decimal 24)\nSet-ADUser iposservice -Replace @{\n    \"msDS-SupportedEncryptionTypes\" = 24\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code class=\"\"># The numerical values for Kerberos AES encryption types to support\n$AES128 = 0x8\n$AES256 = 0x10\n\n# Fetch all users from an OU with their current support encryption types attribute\n$Users = Get-ADUser -Filter * -SearchBase \"OU=SecureUsers,OU=Users,DC=domain,DC=tld\" -Properties \"msDS-SupportedEncryptionTypes\"\nforeach($User in $Users)\n{\n    # If none are currently supported, enable AES256\n    $encTypes = $User.\"msDS-SupportedEncryptionType\"\n    if(($encTypes -band $AES128) -ne $AES128 -and ($encTypes -band $AES256) -ne $AES256)\n    {\n        Set-ADUser $User -Replace @{\"msDS-SupportedEncryptionTypes\"=($encTypes -bor $AES256)}\n    }\n}<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the&nbsp;<em>Group Policy Management (gpmc.msc)<\/em>&nbsp;and navigate to&nbsp;<em>Group Policy Objects<\/em><\/li>\n\n\n\n<li>The following changes should be made in a Group Policy that is applied to all computer objects in the domain.&nbsp;<\/li>\n\n\n\n<li>Open the desired group policy object by right-clicking on it and clicking on&nbsp;<em>Edit<\/em><\/li>\n\n\n\n<li>Navigate to&nbsp;<em>Computer Configuration -&gt; Policies -&gt; Windows Settings -&gt; Security Settings -&gt; Local Policies -&gt; Security Options<\/em><\/li>\n\n\n\n<li>Open the policy&nbsp;<em>Network security: Configure encryption types allowed for Kerberos<\/em><\/li>\n\n\n\n<li>Deactivate the following entries and confirm with a click on&nbsp;<em>OK<\/em>:\n<ol class=\"wp-block-list\">\n<li>DES_CBC_CRC<\/li>\n\n\n\n<li>DES_CBC_MD5<\/li>\n\n\n\n<li>RC4_HMAC_MD5<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/azuregeek.io\/wp-content\/uploads\/2021\/01\/EcnryptionTypesAllowedForKerberos.png\" alt=\"\" class=\"wp-image-2701 img-responsive\"\/><\/figure>\n<\/div>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Check Useage Detect and Remediate RC4 Usage in Kerberos | Microsoft Learn Set all Users to use Kerboros AES128\\256<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-7391","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=7391"}],"version-history":[{"count":4,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7391\/revisions"}],"predecessor-version":[{"id":9561,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/7391\/revisions\/9561"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=7391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=7391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=7391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}