Forcing Windows Password encryption to use AES256

I need to force users passwords to be saved in AD as Kerberos AES256

I have read this article:
http://blogs.msdn.com/b/openspecification/archive/2011/05/31/windows-configurations-for-kerberos-supported-encryption-type.aspx

But when I do a klist tgt it still shows it as :
Session Key        : KeyType 0x17 - RSADSI RC4-HMAC(NT)

and I want to get to a
0x12
aes256-cts-hmac-sha1-96

Have Windows 2008 R2 SBS /2011 as domain controller
911bobCTOAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

btanExec ConsultantCommented:
Kindly see
It is possible (although not recommended from a security perspective) to change the default on the Vista/Win7 client side to start pre-authentication with RC4 by modifying the DefaultEncryptionType registry value to 0x17 hex (0x18 hex is AES).

From KB  837361:
Entry: DefaultEncryptionType
Type: REG_DWORD
Default Value: 23 (decimal) or 0x17 (hexadecimal)

This value indicates the default encryption type for pre-authentication. i.e.
0x17 (hex) or 23 (decimal) is KERB_ETYPE_RC4_HMAC_NT
0x18 (hex) or 24 (decimal) is KERB_ETYPE_AES256_CTS_HMAC_SHA1_96

Vista and Windows Server 2008 clients are unable to access cluster names with AES-encrypted Kerberos tickets http://support.microsoft.com/kb/961302

a)      The security entity running the service; if the msDS-SupportedEncryptionTypes attribute on the object is set to 31 it indicates that it supports AES encryption.  This is normally only set on computer objects that run W2k8 and Vista, if the cluster service created the account or it’s a service account then it shouldn’t be present and AES should not be an option.

b)      The registry key on the DC’s; HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\KdcUseRequestedEtypesForTickets (DWORD); if this is set to non-zero on the DC the DC will attempt to use the highest encryption method the client supports.  This requires the hotfix from 833708 or later builds of kdcsvc.dll to be installed on all W2k3 DC’s, without it the DC defaults to the highest possible encryption method which will be AES for W2k8/Vista clients (W2k8 DC’s already have it)
http://blogs.technet.com/b/instan/archive/2009/10/12/changes-in-default-encryption-type-for-kerberos-pre-authentication-on-vista-and-windows-7-clients-cause-security-audit-events-675-and-680-on-windows-server-2003-dc-s.aspx

either use iiscrypto tool (follow best practice which do not have RC4) to enforce the whole OS schannel crypto list available via disabling RC4 https://www.nartac.com/Support/IISCrypto/FAQ
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gheistCommented:
And the client is?
0
911bobCTOAuthor Commented:
Clients are Windows 7 or Windows 8.1
0
btanExec ConsultantCommented:
My earlier post should be applicable includng the iiscrypto tool. Or disable registry value of schannel which is similar to what the tool is doing too. Pls do backup before test out. The link is more info of the registry and lookout for those stating values in SCHANNEL\Ciphers\RCx where 'x' can be 2 or 4.

https://support.microsoft.com/en-us/kb/245030
0
911bobCTOAuthor Commented:
IISCrypto tool is a great find.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Encryption

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.