kerberos auditing

Kerberos auditing on Windows focuses on monitoring authentication events, particularly Event IDs 4768 and 4769, to detect legacy RC4 cipher usage. Recent updates add new audit fields such as msds-SupportedEncryptionTypes, Available Keys, and Ticket Encryption Type, enabling administrators to identify accounts and devices that lack AES support. Microsoft provides PowerShell scripts and tooling to scan event logs and Active Directory for RC4-dependent entities, helping organizations prepare for the eventual removal of RC4 in Kerberos. This tag covers discussions on enabling and interpreting these audit logs, remediation steps, and best practices for transitioning to stronger encryption in Active Directory environments.