Blog Post

Windows Server News and Best Practices
6 MIN READ

Removal of DES in Kerberos for Windows Server and Client

Anushka_Khare's avatar
Anushka_Khare
Icon for Microsoft rankMicrosoft
Feb 28, 2025

Prepare for removal of Data Encryption Standard (DES) in Kerberos for Windows Server 2025 and Windows 11, version 24H2.

To enhance security and protect against cyber threats, the Data Encryption Standard (DES) encryption algorithm will be intentionally removed from Kerberos after Windows Server 2025 and Windows 11, ve...
Option for "Use only Kerberos DES encryption types for this account" is unchecked in the Active Directory Users and Computers policy.
Updated Feb 28, 2025
Version 2.0
MaxC0der88's avatar
MaxC0der88
Copper Contributor
Feb 28, 2025

When I run Get-KerbEncryptionUsage.ps1 script, I get error like below. 

Index operation failed; the array index evaluated to null.
At C:\Get-KerbEncryptionUsage.ps1:234 char:9
+         $SK = $script:EncryptionValueTypeMap[$_.Properties[22].Value]
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : NullArrayIndex

  • WillAftring's avatar
    WillAftring
    Icon for Microsoft rankMicrosoft
    Feb 28, 2025

    This is most likely due to the scripts taking a dependency on the updated Event Id 4768 and Event Id 4769. 

    These updated events are available on Windows Server 2019 through Windows Server 2025. You can confirm this by seeing if the Event Ids 4768 and Event Id 4769 contain the following field.

    • Session Key Encryption Type

    For additional help on the scripts specifically you can engage with the development team at microsoft/Kerberos-Crypto: Tools and information regarding Windows Kerberos cryptography