rc4 deprecation

Microsoft has quietly but deliberately set a firm deadline to end a decades‑long compatibility compromise: RC4 (RC4‑HMAC) will no longer be the assumed, permissive fallback for Kerberos ticket encryption on Windows domain controllers, and Microsoft has delivered a staged rollout tied to...

Microsoft has begun a staged hardening of Kerberos on Windows domain controllers: starting with security updates released on January 13, 2026, domain controllers will gain new telemetry and audit controls that identify weak Kerberos encryption usage, and Microsoft plans a phased default flip so...

Microsoft is flipping a decades‑old Kerberos default in Windows Server — and IT teams must treat it as an operational deadline, not a theoretical security tweak. Background / Overview Microsoft has announced a change to how the Kerberos Key Distribution Center (KDC) on Windows domain controllers...

Microsoft’s decision to stop issuing RC4-based Kerberos tickets by default on domain controllers is both overdue and consequential: after more than two decades of using RC4‑HMAC as a compatibility fall‑back in Active Directory, Microsoft will flip Kerberos defaults so domain controllers running...

Microsoft has set a firm deadline to end a decades‑long compatibility compromise: by mid‑2026 domain controllers running Windows Server 2008 and later will default to issuing AES‑SHA1 Kerberos session keys and RC4 will be disabled by default, forcing organizations to find and remediate remaining...

Microsoft’s plan to end RC4 as a Kerberos default marks a clear, overdue break with a decades‑old compatibility choice that has long weakened Active Directory security; by mid‑2026 domain controllers running Windows Server 2008 and later will default to issuing AES‑SHA1 session keys for Kerberos...

Microsoft’s decision to flip a long-standing encryption default in Active Directory — moving Kerberos away from RC4 and toward AES-SHA1 by default — is the most consequential security change for Windows authentication in years, and it arrives after more than two decades of compatibility-first...

Microsoft’s decision to phase out the RC4 cipher from Active Directory authentication marks a decisive response to decades of risky backward compatibility — but it also forces a hard reckoning for enterprises that have long depended on legacy interoperability over cryptographic hygiene...