[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More
Experts Exchange Solution brought to you by
"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.
It is possible (although not recommended from a security perspective) to change the default on the Vista/Win7 client side to start pre-authentication with RC4 by modifying the DefaultEncryptionType registry value to 0x17 hex (0x18 hex is AES).
From KB 837361:
Default Value: 23 (decimal) or 0x17 (hexadecimal)
This value indicates the default encryption type for pre-authentication. i.e.
0x17 (hex) or 23 (decimal) is KERB_ETYPE_RC4_HMAC_NT
0x18 (hex) or 24 (decimal) is KERB_ETYPE_AES256_CTS_HMAC_SHA1_96
Vista and Windows Server 2008 clients are unable to access cluster names with AES-encrypted Kerberos tickets http://support.microsoft.com/kb/961302
a) The security entity running the service; if the msDS-SupportedEncryptionTypes attribute on the object is set to 31 it indicates that it supports AES encryption. This is normally only set on computer objects that run W2k8 and Vista, if the cluster service created the account or it’s a service account then it shouldn’t be present and AES should not be an option.
b) The registry key on the DC’s; HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\KdcUseRequestedEtypesForTickets (DWORD); if this is set to non-zero on the DC the DC will attempt to use the highest encryption method the client supports. This requires the hotfix from 833708 or later builds of kdcsvc.dll to be installed on all W2k3 DC’s, without it the DC defaults to the highest possible encryption method which will be AES for W2k8/Vista clients (W2k8 DC’s already have it)
Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.
From novice to tech pro — start learning today.
Premium members can enroll in this course at no extra cost.