Windows Server: Kerberos KDC defaults to AES, RC4 service tickets blocked (CVE-2026-20833)
Summary
Microsoft is hardening the Kerberos Key Distribution Center (KDC) on domain controllers against CVE-2026-20833, an information disclosure flaw that lets attackers obtain RC4-encrypted service tickets for offline password attacks. Since the updates of 14 April 2026, the default for accounts without an explicit encryption setting is AES-SHA1 only. Updates from July 2026 remove the rollback option. Status as of 2026-11-01: the change is live.
What changes?
Kerberos authentication can fail for services or devices (especially non-Windows systems) that still need RC4 and whose accounts have no explicit msds-SupportedEncryptionTypes value. KDCSVC audit events 201 to 209 appear in the System event log of domain controllers; event 205 is logged if an explicit DefaultDomainSupportedEncTypes value allows RC4. Missing audit events do not guarantee that non-Windows devices keep working.
Affected
- Windows Server 2012 ESU and 2012 R2 ESU
- Windows Server 2016, 2019, 2022
- Windows Server, version 23H2
- Windows Server 2025
- Active Directory domain controllers with updates released on or after 13 January 2026 (KB5073381)
Preparation and temporary exceptions
- Check the System event log of all domain controllers for KDCSVC events 201 to 209.
- Remove RC4 dependencies, or explicitly enable RC4 in the msds-SupportedEncryptionTypes attribute of the service accounts that need it.
- Until the July 2026 updates are installed, the rollback value RC4DefaultDisablementPhase can be set manually. Afterwards this subkey is no longer supported.
- Test non-Windows devices for Kerberos interoperability.
Check and complete
No fix needed; this is an intentional hardening. Verify that no KDCSVC audit events are logged and that Enforcement mode is active on all domain controllers (RC4DefaultDisablementPhase = 2 before the July 2026 updates).
Recommendation
Install current updates on all domain controllers, review the KDCSVC events and test non-Windows systems (NAS, Linux, appliances, Java applications). Set msds-SupportedEncryptionTypes explicitly for accounts that still need RC4 and plan to migrate them to AES. See the linked Microsoft guide on detecting and remediating RC4 usage.
Timeline
- Initial deployment phase: updates add KDCSVC audit events (201-209) and support for the registry value RC4DefaultDisablementPhase (set to 2 to enable Enforcement mode early).
- Enforcement phase with manual rollback: the default DefaultDomainSupportedEncTypes changes to AES-SHA1 only (0x18) for accounts without an explicit msds-SupportedEncryptionTypes attribute. Rollback via RC4DefaultDisablementPhase remains possible.
Sources
- How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833 Vendor · support.microsoft.com
- CVE-2026-20833 Vendor · msrc.microsoft.com
- Kerberos protocol registry KDC configuration keys Vendor · learn.microsoft.com
- Detect and remediate RC4 usage in Kerberos Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:16.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.