msDS-SupportedEncryptionTypes: RC4 Still Wins Kerberos

The Trap

RC4-HMAC fallback in Kerberos service ticket encryption, driven by an unset or misconfigured msDS-SupportedEncryptionTypes attribute on accounts holding a Service Principal Name (SPN).

The Default State

msDS-SupportedEncryptionTypes is a bitmask: 0x1 (DES-CBC-CRC), 0x2 (DES-CBC-MD5), 0x4 (RC4-HMAC), 0x8 (AES128-CTS-HMAC-SHA1-96), 0x10 (AES256-CTS-HMAC-SHA1-96). Accounts created before Windows Server 2008 R2 tooling, or provisioned by legacy scripts and third-party applications, ship with this attribute unset entirely. Per MS-KILE, an unset value is treated as supporting RC4 for backward compatibility, regardless of domain functional level. Even domains raised to 2016 functional level and running "Network security: Configure encryption types allowed for Kerberos" with AES ticked will still honour RC4 if this per-object attribute was never explicitly restricted, because the GPO governs client-side negotiation preference, not the KDC’s willingness to issue an RC4-encrypted TGS for that specific account.

The Blast Radius

Any authenticated domain user can request a service ticket for the SPN with kerberos::ask or Rubeus /kerberoast, and the KDC returns a ticket encrypted with a key derived from the service account’s NTLM hash whenever RC4 remains negotiable. That ticket is extracted, converted to hashcat mode 13100, and brute-forced offline with no logon attempts against the DC and no lockout trigger. Service accounts are disproportionately likely to hold static, non-expiring passwords set years earlier, often with elevated rights across file shares, SQL instances, or application tiers. A single cracked account converts silent, unauthenticated reconnaissance into a valid domain credential, and from there into lateral movement, Group Policy abuse, or a path to Domain Admin — all without a single failed authentication event in the Security log.

The Lead Mechanic Fix

Audit every SPN-bearing object with Get-ADObject -LDAPFilter '(servicePrincipalName=*)' -Properties msDS-SupportedEncryptionTypes and flag any value of 0, null, or with bit 0x4 set. Remediate with Set-ADUser -Identity svc-app -KerberosEncryptionType AES128,AES256 (or the equivalent bitmask 0x18 via Set-ADObject -Replace for objects without the cmdlet parameter). Enforce domain-wide with the "Configure encryption types allowed for Kerberos" GPO restricted to AES only, disabling RC4 and DES explicitly. Rotate every affected account’s password to a randomly generated 32+ character value immediately after remediation, since the pre-existing RC4 key material remains crackable from any tickets already captured. Where feasible, migrate standalone service accounts to Group Managed Service Accounts (gMSA), which enforce AES by default and remove static password exposure entirely.