Blog Post

Ask the Directory Services Team
5 MIN READ

What is going on with RC4 in Kerberos?

WillAftring's avatar
WillAftring
Icon for Microsoft rankMicrosoft
Jan 26, 2026
  Howdy everyone! The cat is out of the bag when it comes to Microsoft’s forward outlook on RC4 usage in Kerberos. In the past few months, we have published the following.  Beyond RC4 for Windo...
Updated Jan 26, 2026
Version 1.0
aes
Kerberos
RC4
WillAftring
matt grossman's avatar
matt grossman
Copper Contributor
Feb 01, 2026

Great article. Has the computation of the DefaultDomainSupportedEncTypes value changed in Windows 2025, or is there a different computation for the msds-SupportedEncryptionTypes value? "On Windows Server 2025, this default value is 0x24 (RC4, and AES-SHA1 session keys) because DES has been removed from Windows Server 2025."  0x24 is AES only, and 0x28 is RC4 + AES using the sums of types.  I'm deploying the DefaultDomainSupportedEncTypes value via Group Policy to Windows 2022 domain controllers.

Thanks

 

  • WillAftring's avatar
    WillAftring
    Icon for Microsoft rankMicrosoft
    Feb 02, 2026

    Hello!

     I think the confusion comes from how the msds-SupportedEncryptionTypes bitmask is being interpreted.

    You have said "0x24 is AES only, and 0x28 is RC4 + AES using the sums of types".

    0x24 in binary is 0010 0100, which corresponds to the 3rd and 6th bit. Per the [MS-KILE]: Supported Encryption Types Bit Flags | Microsoft Learn that combination represents RC4 with AES-SHA1 session keys, not "AES only". Meanwhile, 24 in decimal is 0x18 (binary 0001 1000), which has the 4th and 5th bit set and does represent AES-SHA1 only.

    The mismatch seems to be between using 0x24 and decimal 24 when interpreting the bitmask.

    Please let me know if I have misunderstood you.