tech
Microsoft will finally kill obsolete cipher that has wreaked decades of havoc
The weak RC4 for administrative authentication has been a hacker holy grail for decades.
TL;DR
- Microsoft is deprecating the RC4 encryption cipher in Windows Server by mid-2026.
- RC4 has been supported by default in Windows for 26 years and is vulnerable to attacks like Kerberoasting.
- The use of RC4 was a factor in the recent breach of health giant Ascension.
- US Senator Ron Wyden criticized Microsoft for "gross cybersecurity negligence" due to continued RC4 support.
- By default, Windows Server 2008 and later will only allow AES-SHA1 encryption for the Kerberos Key Distribution Center (KDC).
- RC4 will be disabled by default and only used if explicitly configured by a domain administrator.
- Microsoft is providing updated KDC logs and new PowerShell scripts to help administrators identify RC4 usage.
- The transition is challenging due to RC4's long history and widespread use in legacy systems.