For over a decade, legacy cryptographic algorithms have lingered in enterprise networks, sustained by the fear of breaking mission-critical applications. Among these, the Rivest Cipher 4 (RC4) stream cipher remains a persistent threat vector within Active Directory (AD) environments. While long deprecated in transport-layer security (TLS), RC4-HMAC has persisted as a fallback encryption type for the Kerberos protocol.

This cryptographic legacy ends in July 2026. Microsoft is enforcing the final rollout phase of its deprecation initiative, systematically rejecting all RC4 algorithm handshakes for Kerberos (tracked under CVE-2026-20833). For enterprise platform engineers, DevSecOps teams, and database administrators, this change represents a major operational milestone. Failing to proactively audit and remediate RC4 dependencies prior to the July 2026 deadline will result in authentication failures across SQL Server instances, legacy web applications, and cross-forest trust boundaries.

The Mechanics of Kerberoasting and the RC4 Vulnerability

To understand why Microsoft is taking this step, we must examine the intersection of the Kerberos protocol design and modern offline cryptographic attacks.

How Kerberoasting Works

Kerberoasting is a post-exploitation technique targeting Active Directory service accounts. It exploits the way the Kerberos Ticket Granting Service (TGS) issues tickets:

  1. SPN Discovery: An attacker authenticates to the domain as any standard domain user (no administrative privileges required). They query the Active Directory Global Catalog for user accounts that have a registered Service Principal Name (SPN). SPNs link a service instance (e.g., MSSQLSvc/sqlprod01.corp.internal:1433) to a specific Active Directory security principal.
  2. TGS Request: The attacker requests a Kerberos service ticket (TGS-REP) for the targeted SPN from the Domain Controller (Key Distribution Center, or KDC).
  3. KDC Response: The KDC generates the ticket. Crucially, the portion of the ticket containing the session key and authorization data is encrypted using the password hash of the service account associated with that SPN. The KDC sends this encrypted ticket back to the requesting user.
  4. Offline Brute-Forcing: Because the ticket is encrypted with the service account's password hash, the attacker extracts the encrypted payload from memory or network traffic and attempts to decrypt it offline. They use dictionary attacks or brute-force tools (such as Hashcat or John the Ripper) to guess the plaintext password. Since this cracking occurs offline, it evades detection by traditional network-based intrusion detection systems and does not trigger account lockout policies.

The RC4-HMAC Weakness

The choice of encryption algorithm used to encrypt the TGS ticket directly dictates the viability of a Kerberoasting attack. When a service account is configured to support RC4 (rc4-hmac, or encryption type 0x4), the security posture of the entire service relies on an outdated stream cipher.

Under RC4-HMAC, the key used to encrypt the ticket is derived directly from the NT hash of the service account's password. The NT hash is a single iteration of the MD4 hashing algorithm, which is cryptographically weak and extremely fast to compute. Modern GPUs can compute billions of MD4/NT hashes per second.

In contrast, when AES-128 (aes128-cts-hmac-sha1-96, type 0x8) or AES-256 (aes256-cts-hmac-sha1-96, type 0x10) is used, the key derivation process is significantly more complex. AES keys in Kerberos are derived using PBKDF2 (Password-Based Key Derivation Function 2) with HMAC-SHA1, utilizing the user's password, domain name, and username as salt, run over 4,096 iterations. This key derivation function (KDF) introduces a massive computational penalty for attackers. Cracking an AES-encrypted Kerberos ticket offline is orders of magnitude slower and computationally expensive compared to cracking an RC4-encrypted ticket.

By forcing the retirement of RC4, Microsoft is effectively eliminating the low-hanging fruit of Kerberoasting, forcing attackers to target highly complex AES-derived keys that are practically unfeasible to brute-force when paired with strong, complex service account passwords.

The Microsoft Deprecation Timeline and CVE-2026-20833

Microsoft’s strategy to eliminate RC4 from Kerberos is structured as a multi-phase rollout to prevent sudden, widespread operational outages. This phased approach allows administrators to monitor compatibility issues before hard enforcement takes effect.

  • Initial Phase (Audit and Warning): In this phase, domain controllers log warnings when RC4 authentication is negotiated. This allows security teams to identify legacy clients, servers, and trusts that still rely on the weak cipher.
  • Enforcement Phase (July 2026): With the release of the July 2026 Patch Tuesday updates, Microsoft will transition Kerberos to strict enforcement. After this update is applied to domain controllers, the KDC will reject any requests to negotiate RC4-HMAC encryption. If a client or service cannot negotiate AES-128 or AES-256, authentication will fail with a Kerberos error (typically KDC_ERR_ETYPE_NOSUPP or SEC_E_UNSUPPORTED_PREAUTH).

The Role of the msDS-SupportedEncryptionTypes Attribute

The cryptographic capabilities of Active Directory accounts are governed by the msDS-SupportedEncryptionTypes attribute. This attribute is a 32-bit bitmask that defines which encryption algorithms a security principal supports:

  • 0x1: DES-CBC-CRC
  • 0x2: DES-CBC-MD5
  • 0x4: RC4-HMAC
  • 0x8: AES128-CTS-HMAC-SHA1-96
  • 0x10: AES256-CTS-HMAC-SHA1-96

If this attribute is unset (null) or set to 0, Active Directory defaults to a compatibility mode that permits RC4 fallback. To secure an account, this attribute must be explicitly configured to allow only AES algorithms (a value of 24 decimal, which represents the sum of 0x8 and 0x10).

Audit, Remediation, and Configuration Strategies

Remediating RC4 dependencies requires a structured approach: discovery, validation, configuration updates, and verification. Below is the operational playbook for securing your environment.

Step 1: Discovering RC4-Enabled Accounts

Before modifying any configuration, you must identify which service accounts, user accounts, and computer objects are configured to support only RC4, or have not had their encryption types explicitly defined.

The following PowerShell script queries Active Directory for accounts with SPNs (which are targetable by Kerberoasting) and evaluates their msDS-SupportedEncryptionTypes attribute to flag potential vulnerabilities.

# Find Active Directory accounts with SPNs configured for legacy or default encryption
Get-ADUser -Filter * -Properties msDS-SupportedEncryptionTypes, ServicePrincipalName | 
    Where-Object { $_.ServicePrincipalName -ne $null } | 
    Select-Object Name, UserPrincipalName, msDS-SupportedEncryptionTypes, 
        @{Name="Encryption_Status"; Expression={
            $val = $_."msDS-SupportedEncryptionTypes"
            if ($val -eq $null -or $val -eq 0) { "Default (Unconfigured - RC4 Fallback Allowed)" }
            elseif (($val -band 4) -and -not ($val -band 24)) { "Vulnerable: RC4 Only" }
            elseif ($val -band 24) { "Secure: AES Enabled" }
            else { "Custom/Legacy Configuration" }
        }} | 
    Format-Table -AutoSize

Step 2: Remediating Service Accounts and SQL Server

SQL Server service accounts are prime targets for Kerberoasting. If a SQL Server service runs under a domain user account, that account must be updated to support AES.

  1. Update the Active Directory Object: Modify the msDS-SupportedEncryptionTypes attribute of the service account to support AES 128 and AES 256. This can be done via Active Directory Users and Computers (ADUC) by checking the boxes for "This account supports Kerberos AES 128 bit encryption" and "This account supports Kerberos AES 256 bit encryption" in the account properties, or via PowerShell:
    Set-ADUser -Identity "sql_service_account" -Replace @{"msDS-SupportedEncryptionTypes" = 24}
  2. Reset the Account Password: When you enable AES on an existing account, the KDC cannot immediately issue AES keys if the account's password has not been changed since AES was enabled. You must reset the service account's password to force the generation of the AES keys (aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96) in the Active Directory database.
  3. Verify SQL Server Service Principal Names: Ensure that the SPNs are correctly registered for the SQL Server instance using setspn -L <domain\service_account>.

Step 3: Group Policy Configuration for Clients and Servers

To ensure that client computers and member servers do not attempt to negotiate RC4, enforce AES usage via Group Policy Objects (GPOs).

Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options

Configure the policy "Network security: Configure encryption types allowed for Kerberos" to select only:

  • AES128_HMAC_SHA1
  • AES256_HMAC_SHA1
  • Future encryption types (if applicable)

Ensure that RC4_HMAC_MD5 is explicitly deselected.

Remediation Checklist

Action Item Technical Objective Impact & Considerations
Audit AD Objects Identify accounts with msDS-SupportedEncryptionTypes set to null, 0, or 4. Low risk; read-only operations using PowerShell.
Enable AES on Service Accounts Set msDS-SupportedEncryptionTypes to 24 (AES128/AES256). High risk if the client operating system is extremely old (e.g., Windows Server 2003).
Reset Service Account Passwords Force generation of AES keys in AD database. Requires scheduled maintenance window to restart associated services.
Update Group Policies Restrict allowed Kerberos encryption types on clients and servers. Ensures local security authorities (LSASS) reject RC4 negotiations.
Review Forest Trusts Ensure cross-forest trusts are configured to support AES. Crucial for multi-forest enterprises to prevent cross-boundary authentication failures.

Conclusion

The retirement of RC4 encryption in Kerberos (CVE-2026-20833) is a necessary step to secure modern enterprise identity infrastructure. While the July 2026 deadline provides a runway for migration, the operational dependencies involved—specifically password resets for legacy service accounts and updating cross-forest trust configurations—require systematic planning and execution.

By executing a discovery phase today, updating service accounts to support AES-128/256, and enforcing cryptographic standards via Group Policy, DevSecOps and engineering teams can neutralize the threat of Kerberoasting and ensure a seamless transition when Microsoft enforces the final deprecation phase.

Sources

  • RC4 Is Going Away in July 2026: What CVE-2026-20833 Means for Your SQL Server and Windows Environment — Web source, 2026-06-24
  • July 2026 Patch Tuesday: Is CVE Tracking Still Effective? - News4hackers — Web source, 2026-07-10