Identity and Secure Access

Retiring RC4 from Active Directory: Microsoft's timeline and why dependencies are hard to find

Microsoft is phasing out RC4 encryption in Kerberos (related to CVE-2026-20833). The problem is that most environments have thousands of accounts with an unspecified encryption type that still allowed RC4 on the domain controller side – which is a Kerberoasting vector.

  • SourceSilverfort
  • Source PublicationMay 7, 2026
  • TypeTechnologies and Vendors

What happened

Timeline: The January 2026 update enables the audit phase – RC4 works, but its use is logged. April 2026 begins enforcement: for accounts with an unspecified msDS-SupportedEncryptionTypes attribute, the Key Distribution Center defaults to AES only, which may break authentication for dependent service accounts and machines (there is a temporary registry key to roll back the change). July 2026 removes this loophole: RC4 only works where it has been explicitly configured on the account, which Microsoft does not recommend.

RC4 is dangerous because its tickets enable Kerberoasting: any valid domain account can request a service ticket and crack it offline, without privilege escalation and without an alert. RC4 is cracked much faster than AES, especially for service accounts with weak passwords.

Key findings

  • Accounts with unspecified msDS-SupportedEncryptionTypes have historically allowed RC4 – there are thousands of them in most environments.
  • Service accounts whose passwords were set before Windows Server 2008 do not have AES keys; simply raising the domain functional level does not fix this, but a password reset does.
  • Machines older than Server 2008 do not support AES, so RC4 remains a hard requirement for them until they are replaced.
  • Silverfort flags weak encryption for users and servers, accounts with old passwords, and legacy operating systems in the ISPM module, and allows filtering authentication logs by RC4-HMAC tickets.

Why it matters

SafeWave CommentaryEnforcement began in April, and the registry loophole disappeared in July 2026 – those who did not inventory RC4 dependencies risk both broken authentication (when AES is enforced on an account without an AES key) and an open Kerberoasting vector (where RC4 was left explicitly). Practically: reset passwords for old service accounts to generate AES keys; identify pre-2008 machines and plan exceptions or retirement; do not rely on the registry key; track remediation progress with continuous monitoring of authentication logs.