How to Manage RC4 Hardening – Definitive Guide

A short follow-up question regarding auditing and the 4769 event shown in the screenshot.

In the screenshot, the Ticket Encryption Type is 0x12 while the Session Encryption Type is 0x17.

Most technical articles and guidance currently state that environments should primarily audit for Ticket Encryption Type 0x17 and remediate those RC4-related events before the April/July 2026 Kerberos RC4 enforcement changes.

However, in our environment, we are seeing a relatively high number of events matching the scenario shown in the screenshot:

- Ticket Encryption Type = 0x12 (AES256)

- Session Encryption Type = 0x17 (RC4)

Do these events also play a relevant role regarding the April and July 2026 updates?

Should events with:

- Ticket Encryption Type = 0x12

- Session Encryption Type = 0x17

also be considered problematic and remediated before installing the July 2026 updates, or is the primary focus only on events where the Ticket Encryption Type itself is 0x17?

Additionally, we are also seeing mixed values in the “Advertized Etypes” field for these events under „Network Information“. In some cases, only RC4-HMAC is listed, while in other cases both RC4 and AES encryption types are shown.

Could you clarify what this indicates and how these events should be interpreted?

We are especially confused because, in some of the events where only RC4-HMAC is shown in the Advertized Etypes field, the Network Information references a standard Windows 11 client or Windows Server, which should normally support AES without issues.

Thank you very much for any clarification.