So, you think you’re ready for enforcing AES for Kerberos?

Thank you! Especially for the "how to find those using old hash" part at the beginning, which is so very important.

Question for the XML event filter: I always add the "provider", in this case probably [Provider[@Name='Microsoft-Windows-Security-Auditing']]. which speeds up the similar query for NTLMv1 usage at factor five to ten. Will have to check whether the difference is the same here.. Using the TimeCreated[@SystemTime>'$OldestEventUTC'] speeds it up too by limiting how far in the past it should go. I use that for "export those log events daily" on busy domain controllers.