Table of Contents
Why is RC4 dangerous for Kerberos and how can administrators switch to AES?
Microsoft Authentication Update: The End of RC4 Support
Microsoft has officially scheduled the retirement of the Rivest Cipher 4 (RC4) algorithm for Windows authentication. By mid-2026, Microsoft will disable RC4 support within the default settings of the Kerberos Key Distribution Center (KDC). This change applies to all domain controllers running Windows Server 2008 and later. This mandate forces a permanent migration to the stronger AES encryption standard.
Why RC4 Is Obsolete
RC4 is a stream encryption algorithm created in 1987. It is cryptographically broken. While the code remained secret initially, a 1994 leak exposed the source. By 2001, researchers Scott Fluhrer, Itsik Mantin, and Adi Shamir demonstrated practical attacks against it. Consequently, the Internet Engineering Task Force prohibited RC4 use in TLS protocols via RFC 7465 in 2015.
The Security Risk: Kerberoasting
Continued use of RC4 in Active Directory creates severe security liabilities. The primary threat is “Kerberoasting.” In this attack scenario, adversaries request Kerberos service tickets encrypted with RC4. Because RC4 is weak, attackers can easily crack these tickets offline to reveal plaintext passwords of service accounts. If your environment permits RC4, you invite this specific vulnerability.
Advisory for System Administrators
The transition to AES is critical for business continuity. AES-SHA1 and newer standards have been available since Windows Server 2008. Most modern systems utilize AES automatically. However, legacy configurations often retain RC4 dependencies.
Immediate Actions Required
If you do not remove RC4 dependencies before the summer 2026 update, user and service authentication will fail. You must act now to prevent network outages.
- Audit Your Environment: Utilize PowerShell scripts and inspect Windows Event Logs to detect clients or accounts still authenticating via RC4.
- Transition to AES: Reconfigure the KDC and specific service accounts to enforce AES encryption.
- Verify Configuration: Ensure no explicitly configured RC4 flags remain on domain administrator accounts.
Secure Windows authentication functions perfectly without RC4. This deprecation is a necessary step toward hardening your infrastructure against modern identity attacks.