RC4-to-AES cutovers: what IAM teams need to catch before migration

TL;DR: Active Directory migration cutovers can expose RC4-dependent service accounts that looked healthy in source domains but fail in AES-default targets, because standard tooling copies NTLM hashes without regenerating AES keys, according to Semperis. The real risk is not universal breakage, but a predictable failure class that identity teams need to discover before July 2026 enforcement.

Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “RC4 and AD Migration: Uncover the Break Scenarios Hiding in Your Source Domain”.

Key questions

Q: What breaks when service accounts are migrated without regenerating AES keys?

A: Kerberos authentication can fail even when the account still exists, has the right group membership, and appears to support AES.

Q: Why do RC4-to-AES cutovers create outage risk in Active Directory migrations?

A: They change the enforcement baseline at the same moment identities cross domains.

Q: How can teams tell whether an RC4 dependency is real or just hidden by steady-state use?

A: Look for accounts that authenticate successfully only because their tickets are already cached or because they rarely re-authenticate.

Practitioner guidance

• Inventory service accounts by key-state, not just attribute-state Check whether accounts with AES bits set actually have AES keys in the target domain, and prioritise old or never-reset accounts first.
• Correlate directory data with Kerberos event evidence Use authentication and service-ticket events to find accounts that claim AES support but still request RC4, then validate those identities before cutover.
• Map migration-specific dependencies by application and host Walk Linux, Java, appliance, and trust-based dependencies to find keytabs, hardcoded encryption settings, and other RC4-pinned paths that AD queries will not reveal.

Bottom line: The article’s core risk is a Kerberos mismatch where migrated accounts still look valid in Active Directory but fail once the target domain enforces AES expectations.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →