Kerberos RC4 protections move to enforcement on domain controllers

Windows ServerActive Directory

Who is affected

Active Directory domains with service accounts or applications that still depend on RC4 Kerberos tickets. Audit mode and the temporary rollback registry setting were removed with this update.

What to do

1. Review domain controller events for service tickets still requested with RC4.
2. Enable AES on the affected service accounts and reset their passwords so AES keys exist.
3. Retire or upgrade applications and appliances that cannot use AES.

Source

Enforcement phase for Kerberos RC4 protections begins with the July 2026 Windows security update“The July 2026 Windows security update enables Enforcement mode across Windows domain controllers for Kerberos RC4 protections related to CVE‑2026‑20833.”

Checked 9 Nov 2026 Link to this deadline