Topic

Active Directory Hardening

Coverage tagged active directory hardening.

Articles: 1
Desk: 1

Data graphic: Kerberos RC4 deprecation, with July 2026 as the date the RC4DefaultDisablementPhase registry rollback is removed, set out as a three-phase rollout: audit on January 13, AES-SHA1 0x18 default enforcement on April 14 with an override that can be set to 1 to defer, and mandatory AES in July 2026 when the override is ignored. It adds CVE-2026-20833 CVSS 5.5 Medium , the 0x18 = AES128 + AES256 target against RC4 tickets etype 23 / 0x17 , and a warning that setting 0x18 without resetting the service account's password leaves the account with no AES keys.

stableResearch Active Directory Hardening

Active Directory Hardening: Navigating Kerberos RC4 Deprecation and the July 2026 Registry Override Removal

Microsoft's Kerberos RC4 phase-out reached its final stage with the July 2026 updates, which drop the registry rollback. What still breaks and how to move service accounts to AES.

Jul 28 · 8 min