Information
Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'
This policy setting allows you to set the encryption types that Kerberos is allowed to use.
The recommended state for this setting is: 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'.
Note: Some legacy applications and OSes may require 'RC4_HMAC_MD5' - we recommend you test in your environment and verify whether you can safely remove it. For the purposes of scoring we have allowed the use of 'RC4_HMAC_MD5' as an optional setting.
Rationale:
The strength of each encryption algorithm varies from one to the next, choosing stronger algorithms will reduce the risk of compromise however doing so may cause issues when the computer attempts to authenticate with systems that do not support them.
Solution
To establish the recommended configuration via GP, set the following UI path to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types':
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Configure encryption types allowed for Kerberos
Impact:
If not selected, the encryption type will not be allowed. This setting may affect compatibility with client computers or services and applications. Multiple selections are permitted.
Note: Windows Server 2008 (non-R2) and below allow DES for Kerberos by default, but later OS versions do not.