Do you want to 𝗱𝗶𝘀𝗮𝗯𝗹𝗲 𝗥𝗖𝟰 𝗶𝗻 𝘆𝗼𝘂𝗿 𝗱𝗼𝗺𝗮𝗶𝗻?

You definitely should!

𝗚𝗼𝗼𝗱 𝗻𝗲𝘄𝘀: Microsoft has updated Kerberos auditing (Event ID 4768 & 4769) to make it much easier to track encryption usage.

𝗪𝗵𝘆 𝗱𝗼𝗲𝘀 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿?
You can now quickly identify accounts that still rely on RC4 and might break if you enforce AES.

What’s new in the event logs?
✅ MSDS-SupportedEncryptionTypes
✅ Available Keys
✅ Advertised Etypes
✅ Session Encryption Type
✅ Pre-Authentication Encryption Type

Next Steps:
1️⃣ Start collecting these events in your SIEM/logging system.
2️⃣ Identify accounts that don’t support AES.
3️⃣ Plan your RC4 phase-out safely.

Thank you Jerry Devore for sharing the news. Make sure to check out Jerry's blog: Active Directory Hardening Series - Part 4 – Enforcing AES for Kerberos

Are you already tracking this? Drop a comment if you need help! 👇