Note: 3/5/2026 The Event Forwarding methods mentioned here is not yet compatible with Server 2025. This post will be updated when it is no longer the case. This blog was originally posted last year, but got "lost." It has been updated a little to reflect recent events and will likely have some overlap.
Hello again all, Chris Cartwright here from the Directory Services support team. We released the plan to remove DES as an encryption type for Kerberos completely. We also released identification scripts to assist with this at microsoft/Kerberos-Crypto: Tools and information regarding Windows Kerberos cryptography. We have also released Beyond RC4 for Windows authentication | Microsoft Windows Server Blog and then the first patching efforts in support of RC4 deprecation in How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833 - Microsoft Support.
I wanted to provide a brief update for XML filtering that was illustrated in the previous blog post, So, you think you’re ready for enforcing AES for Kerberos?. I will reference this blog post quite a bit. While I don’t expect readers of this blog to be using DES, I still wanted to make sure that the information was out there. Additionally, the Events 4768 and 4769 have been updated with additional information when issuing tickets. The XML here is also modified to support that.
XML Filters
Here are the XML filters you can leverage to find specific events.
Hunting down DES tickets issued
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='TicketEncryptionType']='0x1']]
</Select>
</Query>
<Query Id="1" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='TicketEncryptionType']='0x2']]
</Select>
</Query>
<Query Id="2" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='TicketEncryptionType']='0x3']]
</Select>
</Query>
</QueryList>
Hunting down only legacy keys available:
There will be more information on this in a later blog post.
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='AccountAvailableKeys']='RC4, DES']]
</Select>
</Query>
<Query Id="1" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='ServiceAvailableKeys']='RC4, DES']]
</Select>
</Query>
<Query Id="3" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='DCAvailableKeys']='RC4, DES']]
</Select>
</Query>
<Query Id="4" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='AccountAvailableKeys']='RC4']]
</Select>
</Query>
<Query Id="5" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='ServiceAvailableKeys']='RC4']]
</Select>
</Query>
<Query Id="6" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='DCAvailableKeys']='RC4']]
</Select>
</Query>
</QueryList>
Hunting down RC4 Tickets issued:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[
Data[@Name='TicketEncryptionType']='0x17' or
Data[@Name='SessionKeyEncryptionType']='0x17'
]]
</Select>
</Query>
</QueryList>
Custom Event Forwarder targets
If you choose to, you can leverage this XML file (or create your own) for Event forwarding described in the previous blog and get this for targets:
Manifest text
<?xml version="1.0"?>
<instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace">
<instrumentation>
<events>
<provider name="WEC-Legacy Hunter" guid="{8D8635E8-3573-49B6-A5CE-A91601E1B5D9}" symbol="EvtFwdLegHunt" resourceFileName="C:\Windows\system32\Legacy-Hunter-WEC.dll" messageFileName="C:\Windows\system32\Legacy-Hunter-WEC.dll">
<channels>
<channel name="RC4 Keys Only" chid="RC4 Keys Only" symbol="RC4KeysOnly" type="Operational" enabled="true" message="$(string.WEC-Legacy-Hunter.channel.RC4KeysOnly.message)"></channel>
<channel name="RC4 Used" chid="RC4 Used" symbol="RC4Used" type="Operational" enabled="true" message="$(string.WEC-Legacy-Hunter.channel.RC4Used.message)"></channel>
<channel name="DES Used" chid="DES Used" symbol="DESUsed" type="Operational" enabled="true" message="$(string.WEC-Legacy-Hunter.channel.DESUsed.message)"></channel>
</channels>
</provider>
</events>
</instrumentation>
<localization>
<resources culture="en-US">
<stringTable>
<string id="WEC-Legacy-Hunter.channel.RC4Used.message" value="RC4 Ticket issued"></string>
<string id="WEC-Legacy-Hunter.channel.RC4KeysOnly.message" value="RC4 Keys Only"></string>
<string id="WEC-Legacy-Hunter.channel.DESUsed.message" value="DES Ticket issued"></string>
</stringTable>
</resources>
</localization>
</instrumentationManifest>
Visual Studio
Previous steps for configuring Visual Studio are in the previous blog post referred to earlier. In order to get the WEC-Legacy-Hunter event logs as shown above, create a New Windows Desktop Wizard Project
Click Create, and choose Dynamic Link Library as Application type. Make sure Empty Project is checked.
Right click on the right side and choose Add Existing Item
Select the .rc and .h files.
You should see the files showing in the project as shown below:
On the top Menu bar, select Project->Properties, and set /NOENTRY under Linker\Advanced.
Then, in the top Menu bar, click Build->Build Solution. In your project folder, there will be a dll file under .\x64\Debug.
You can leverage the steps from the previous blog to install the manifest and point each subscription to the intended destination event log like so:
See previous blog for more details on configuring Event Forwarding.
Once again, good hunting!
Microsoft
