Windows Server: Kerberos KDC defaults to AES, RC4 service tickets blocked (CVE-2026-20833)
Microsoft is hardening the Kerberos Key Distribution Center (KDC) on domain controllers against CVE-2026-20833, an information disclosure flaw that lets attackers obtain RC4-encrypted service tickets for offline password attacks. Since the updates of 14 April 2026, the default for accounts without an explicit encryption setting is AES-SHA1 only. Updates from July 2026 remove the rollback option. Status as of 2026-11-01: the change is live.
Microsoft · Windows Server
