Blog Post

Core Infrastructure and Security Blog
14 MIN READ

How to Manage RC4 Hardening – Definitive Guide

Elanor92's avatar
Elanor92
Icon for Microsoft rankMicrosoft
Apr 29, 2026
How to Manage RC4 Hardening – Definitive Guide This article is a technical continuation of the RC4 deprecation / Kerberos hardening work I covered in my previous article last month. If you already ...
Updated May 28, 2026
Version 2.0
Active Directory
aes
hardening
RC4
GarFin's avatar
GarFin
Copper Contributor
May 24, 2026

Hi, hopefully just the one small detail..

msDS-SupportedEncryptionTypes

This attribute is found on all domain objects in the attribute editor tab.

Value available for the attribute:

  • Null, not set or 0x0: the encryption used depends on the value reported on the DefaultDomainSupportedEncTypes key
  • 0x3C: enables RC4 AES and AES encryption key
    • Flags enabled: RC4-HMAC, AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96-SK
  • 0x38: enables AES and AES encryption key only
    • Flags enabled: AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96-SK
  • 0x18: enables AES only
    • Flags enabled: AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96

 

...and yet the screenshot provided shows 0x1c as being applied.

Elanor92's avatar
Elanor92
Icon for Microsoft rankMicrosoft
May 28, 2026

Hi, thank you for pointing that out. Yes, the value 0x1C is available also for the msDS-SupportedEncryptionTypes, I'll update the article asap