MicrosoftIs the Registry Key DefaultDomainSupportedEncTypes still respected by a Windows Server 2025 Domain Controller? We are facing issues with accounts where no msds-SupportedEncryptionType is set and it looks like the behavior has been changed from previous windows server versions.
MicrosoftThe DefaultDomainSupportedEncTypes (DDSET) registry key is still honored on Windows Server 2025.
I suspect the difference is on older Windows version, there are edge cases where instead of honoring the DDSET, the encryption type selection would fall back to a hard-coded encryption type selection mask.
To get a better sense of how things operate on Windows Server 2025, I would recommend trying out the Kerberos EType Calculator.
