(Updated) Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update

Updated March 20, 2026: Added additional guidance for devices using Azure Files SMB with Active Directory–based authentication and Azure Virtual Desktop.

Windows updates released April 2026 and later introduce the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configured.

Beginning with the April 2026 Windows security update, domain controllers will default to issuing AES‑SHA1-encrypted tickets for accounts that do not explicitly define supported encryption types. Environments with service accounts, applications, or devices that still require RC4-based Kerberos tickets may see authentication or connection failures unless those dependencies are addressed. Kerberos-related events in the System event log can help identify and address misconfigurations or remaining dependencies that are likely to become incompatible as enforcement progresses.

Note: For devices using Azure Files SMB with Active Directory–based authentication, address any RC4 dependencies before the Enforcement phase begins to reduce the risk of access disruption as Audit mode is removed in July 2026. Follow the steps in the official documentation to help maintain uninterrupted access to Azure Files and Azure Virtual Desktop.

Monitor the System event log for Kerberos-related events indicating RC4 dependencies or insecure encryption configurations. If event log data shows RC4 reliance, remediate by moving to stronger encryption or explicitly configuring the account’s msds-SupportedEncryptionTypes attribute where RC4 is still required. Complete these actions before July 2026, when Audit mode is removed and Enforcement mode becomes the only available option.

Note: Audit events related to this change are only generated when Active Directory is unable to issue AES‑SHA1 service tickets or session keys. The absence of audit events does not guarantee that all non-Windows devices will successfully accept Kerberos authentication after the April 2026 Enforcement phase begins. Validate non-Windows interoperability through testing before broadly enabling this behavior.