Strengthening Security: Enabling Higher Encryption Types for Kerberos in Active Directory with Windows 11 24H2

As we advance into an era where cybersecurity threats are becoming increasingly sophisticated, it’s imperative to bolster our defenses to ensure the safety and integrity of our digital environments. One pivotal aspect of this defense is the encryption types used by the Kerberos protocol within an Active Directory (AD) domain. With the release of Windows 11 24H2, enabling higher encryption types for Kerberos isn’t just an option—it’s a necessity. Here’s why and how to make this crucial update.

Understanding Kerberos and Its Role

Kerberos is a network authentication protocol designed to provide strong authentication for client-server applications by using secret-key cryptography. It’s a cornerstone of security within AD environments, ensuring that data exchanged over the network is secure from unauthorized access and tampering.

The Evolution of Encryption Standards

Historically, older encryption standards like DES (Data Encryption Standard) were used within Kerberos. However, as computational power and techniques have advanced, these older standards have become vulnerable to attacks. The adoption of stronger encryption types, such as AES (Advanced Encryption Standard), is critical to maintaining a robust security posture.

Why Higher Encryption Types Matter

1. Enhanced Security: Higher encryption types offer stronger protection against brute-force attacks, eavesdropping, and other forms of cyber threats. By enabling AES encryption, you significantly reduce the risk of unauthorized access to sensitive data.
2. Compliance Requirements: Many regulatory standards and industry best practices mandate the use of strong encryption to protect sensitive information. Upgrading to higher encryption types ensures compliance with these regulations.
3. Future-Proofing: As new vulnerabilities are discovered and exploited, staying ahead with the latest encryption standards ensures that your network remains resilient against emerging threats.

Implementing Higher Encryption Types in Windows 11 24H2

To enable higher encryption types for Kerberos in your AD domain with Windows 11 24H2, follow these steps:

1. Update Group Policy: Access the Group Policy Management Console (GPMC) on your domain controller. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Look for the policy named “Network security: Configure encryption types allowed for Kerberos” and enable it.
2. Specify Encryption Types: In the policy settings, specify the encryption types you want to allow. For maximum security, select AES256_HMAC_SHA1 and AES128_HMAC_SHA1.
3. Update Domain Controllers: Ensure that all domain controllers in your environment are updated to Windows Server versions that support the selected encryption types.
4. Test and Monitor: After enabling higher encryption types, thoroughly test the changes to ensure compatibility with your existing applications and services. Monitor the environment for any authentication issues and address them promptly.

Conclusion

Enabling higher encryption types for Kerberos in your Active Directory domain with Windows 11 24H2 is a crucial step towards fortifying your network security. By adopting stronger encryption standards, you protect your organization against evolving threats and ensure compliance with security regulations. Embrace these changes to future-proof your environment and safeguard your digital assets.

Secure your realm—empower Kerberos with the encryption it deserves.

In some cases older AD networks run into issues when clients get updated or deployed with 24H2, mostly turns out to be caused by an old gpo setting forcing only old kerberos authentication methods to be supported on the network that no longer are part of 24H2, another good reason to get those methods updated asap.

To log who is using older Kerberos encryption types, you can follow these steps:

Enable Auditing: Ensure that auditing for Kerberos Service Ticket Operations is enabled on your Domain Controllers. This can be done via Group Policy:

Open the Group Policy Management Console (gpmc.msc).
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Logon.
Enable the Audit Kerberos Authentication Service policy and configure it to log both success and failure events.

Use PowerShell: You can use a PowerShell script to filter and identify events related to older encryption types. For example, to detect RC4 encryption, you can use the following script:

$Events = Get-WinEvent -Logname security -FilterXPath "Event[System[(EventID=4769)]] and Event[EventData[Data[@Name='TicketEncryptionType']='0x17']] or Event[EventData[Data[@Name='TicketEncryptionType']='0x18']]" | Select-Object @{Label='Time';Expression={$_.TimeCreated.ToString('g')}},
@{Label='UserName';Expression={$_.Properties[0].Value}}, @{Label='IPAddress';Expression={$_.Properties[6].Value}},
@{Label='ServiceName';Expression={$_.Properties[2].Value}}, `
@{Label='EncryptionType';Expression={$_.Properties[5].Value}}
$Events | Out-GridView

Review Logs: After running the script, review the output to identify users and services that are using older encryption types like RC4, make sure they are ready to work with higher encryption before diabling the old ones.