Topic starter
06/06/2026 11:15 am
TL;DR: Microsoft’s RC4 deprecation for Kerberos begins with auditing in January 2026, manual rollback in April, and full enforcement in July, making legacy service accounts and unsupported applications the immediate risk, according to Semperis. The real issue is not encryption alone, but the long tail of RC4-only identity dependencies hidden in Active Directory.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “How to Audit Your Environment for RC4 Encryption”.
Key questions
Q: What breaks when RC4 is removed from Kerberos authentication?
A: Service and machine accounts that still depend on RC4 will fail to authenticate, which can take down applications and automated processes that rely on Active Directory tickets.
Q: Why does RC4 deprecation matter for Kerberoasting risk?
A: RC4 matters because it weakens Kerberos ticket encryption enough that attackers can take service tickets offline and brute-force the recovered material.
Q: How can teams tell whether RC4 is still active in Active Directory?
A: Look for event IDs 4768 and 4769 in the Security log and inspect the ticket encryption and session encryption fields for 0x17.
Practitioner guidance
- Audit Kerberos ticket use now Search Security logs for event IDs 4768 and 4769, then flag any ticket or session encryption value of 0x17 to identify RC4-dependent identities and services.
- Reset stale service account passwords twice For accounts that still lack AES keys, reset the password twice so Active Directory generates the required AES-compatible keys and the account can stop relying on RC4.
- Validate service ticket auditing in every domain Enable Audit Kerberos Authentication Service and Audit Kerberos Service Ticket Operations for success and failure across each domain controller OU before you rely on the logs for discovery.
Bottom line: RC4 deprecation turns a cryptography change into an Active Directory dependency audit, because hidden service account and application bindings will fail when enforcement arrives.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:55 am
RC4 deprecation is really a hidden dependency disclosure event: The first governance problem is not the cipher change itself but the inventory gap it exposes. Many AD programmes assume Kerberos encryption is already standardized, yet the article shows that legacy service accounts and applications can still be pinned to RC4 without obvious user-visible symptoms. The practitioner conclusion is simple: if you do not know which identities still require RC4, you do not actually know your Kerberos estate.
A question worth separating out:
Q: How should identity teams prepare for Kerberos RC4 enforcement?
A: They should inventory every RC4-dependent account, determine which applications or member servers use those identities, and test AES-compatible authentication before the enforcement date. The remediation path depends on whether the problem is an old password, an unsupported client, or an application that needs redesign. The goal is controlled migration, not emergency replacement.
👉 Read our full editorial: RC4 deprecation exposes hidden Kerberos app dependencies in AD