A Windows security hardening change beginning in April 2026 updates default Kerberos encryption behavior and may impact FSLogix profile access for customers using SMB plus Active Directory storage. If your environment still relies on RC4 or has encryption settings left unset (null), you may see authentication issues unless you move to AES-SHA1. Review your configuration now, especially for non-Azure Files SMB storage, or Azure Files with AD DS where remediation is recommended by the end of June 2026.
Beginning with the April 2026 Windows cumulative update, Kerberos default behavior changes: when an Active Directory object’s encryption type is not explicitly set (null), Windows will default to AES...
Updated Mar 27, 2026
Version 1.0
Jason_Parker
Microsoft
Microsoft