v-jfanca/cve-2026-20833-rc4-kerberosKerberos RC4 deprecation: detection, remediation and guidance (CVE-2026-20833)
This repository consolidates technical documentation, PowerShell scripts, Power BI dashboards, and official Microsoft references related to the progressive deprecation of RC4 in Kerberos for Active Directory environments, as part of Microsoft's security changes addressing CVE-2026-20833.
The objective is to support organizations with:
[!NOTE] The materials in this repository are intended to assist organizations in identifying legacy Kerberos dependencies and preparing their environments before Microsoft enforcement phases begin.
RC4 is considered cryptographically weak and is being removed as an implicit fallback mechanism in Kerberos authentication.
This is not simply a hardening recommendation — it represents a structural behavior change in the Kerberos Key Distribution Center (KDC).
Organizations that still rely on RC4 may experience authentication failures when the enforcement phases begin.
Microsoft plans to introduce enforcement changes through security updates with key milestones expected in:
[!WARNING] Environments that still depend on RC4 may experience Kerberos ticket issuance failures once enforcement phases begin.
Understanding and eliminating RC4 dependencies before enforcement begins is critical.
cve-2026-20833-rc4-kerberos
│
├─ docs/
│ Kerberos technical documentation
│
├─ scripts/
│ PowerShell scripts for Kerberos auditing
│
├─ dashboards/
│ Power BI dashboards for RC4 monitoring
│
└─ images/
Diagrams and screenshots used in documentation
Complete technical documentation explaining:
English version:
Portuguese version:
These documents include:
Scripts provided in this repository are used to audit Kerberos encryption usage across Domain Controllers.
Official Microsoft reference scripts:
Improved auditing script provided in this repository:
Enhancements include:
Script documentation:
[!NOTE] The improved script is based on the official Microsoft detection script and preserves its analytical logic while improving usability for operational environments.
The repository includes a Power BI dashboard designed to analyze Kerberos encryption usage.
Dashboard documentation:
Dashboard file:
The dashboard allows security teams to:
Kerberos auditing relies primarily on the following Security Event Log entries.
| Event ID | Description |
|---|---|
| 4768 | Kerberos authentication ticket request (AS) |
| 4769 | Kerberos service ticket request (TGS) |
Recent Windows updates also introduce diagnostic events for RC4 detection and enforcement.
| Event ID | Description |
|---|---|
| 201 | RC4 detected because the client advertises only RC4 |
| 202 | RC4 detected due to missing AES keys |
| 203 | RC4 blocked (enforcement phase) |
| 204 | RC4 blocked due to missing AES keys |
| 205 | Explicit insecure encryption policy detected |
| 206 | Client does not advertise AES |
| 207 | Service configured for AES but account lacks AES keys |
| 208 | RC4 blocked because service only accepts AES |
| 209 | Kerberos encryption negotiation failures |
[!NOTE] These events are introduced by security updates related to CVE-2026-20833 and are critical for identifying environments that still rely on RC4.
Microsoft documentation and guidance related to Kerberos RC4 deprecation.
Detect and remediate RC4 usage in Kerberos
https://learn.microsoft.com/windows-server/security/kerberos/detect-remediate-rc4-kerberos
Kerberos RC4 KDC changes (KB5073381)
https://support.microsoft.com/en-gb/topic/how-to-manage-kerberos-kdc-usage-of-rc4-for-service-account-ticket-issuance-changes-related-to-cve-2026-20833-1ebcda33-720a-4da8-93c1-b0496e1910dc
Beyond RC4 for Windows authentication
https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication/
AskDS — What is going on with RC4 in Kerberos?
https://techcommunity.microsoft.com/blog/askds/what-is-going-on-with-rc4-in-kerberos/4489365
AskDS — Preparing for AES enforcement in Kerberos
https://techcommunity.microsoft.com/blog/askds/so-you-think-you%E2%80%99re-ready-for-enforcing-aes-for-kerberos/4080124
This repository is designed for professionals responsible for identity infrastructure security:
It provides guidance for environments preparing for the removal of RC4 from Kerberos authentication flows.
[!CAUTION] This repository is provided for educational and operational guidance only.
Configuration changes such as modifying:
msDS-SupportedEncryptionTypes
or disabling legacy encryption types should always be validated in a lab or staging environment before being applied to production systems.
Incorrect configuration may lead to Kerberos authentication failures or service outages.