!!! Overview[1] [{$pagename}] is the [encryption] [algorithms] supported by user, computer or trust accounts. The [KDC] uses [{$pagename}] information while generating a [Service Ticket] for this account. Services and Computers can automatically update this attribute on their respective accounts in [Microsoft Active Directory], and therefore need write [access] [Permission] to this attribute. !! [{$pagename}] Values [{$pagename}] values are defined in [Kerberos Encryption Types] (like [Cipher Suites]) When editing the [{$pagename}] attribute, you have to combine the appropriate [bits] to get an [integer] value for the attribute Additionally the [UserAccountControl] attribute, you [SHOULD] also remove the [Windows registry] [USE_DES_KEY_ONLY] (0x200000) bit to disable forcing the use of [DES] key. Decoding [{$pagename}] [Bitmask]: * 0x01 - [DES]-[CBC]-[CRC] * 0x02 - [DES]-[CBC]-[MD5] * 0x04 - [RC4]-[HMAC] * 0x08 - [AES128|AES-128]-CTS-[HMAC]-[SHA1]-96 [Hash Function] with mac truncated to 96 [bits] * 0x10 - [AES256|AES-256]-CTS-[HMAC]-[SHA1]-96 [Hash Function] with mac truncated to 96 [bits] !! [LDAP] [Microsoft Active Directory] [Attribute] Definition The [{$pagename}] [AttributeTypes] is defined as: * [OID] of [1.2.840.113556.1.4.1963] * [NAME|Attribute-Name]: [{$pagename}] * [DESC]: * [OBSOLETE flag] (only if present) * [Supertype]: ** (only if present) * [EQUALITY]: [] * [ORDERING]: [] * [SYNTAX]: [2.5.5.9] * [SINGLE-VALUE] * [USAGE]: [UserApplications] * [Extended Flags]: ** [X-SYSTEMFLAGS]: [FLAG_SCHEMA_BASE_OBJECT] ** [X-SCHEMAFLAGSEx]: [FLAG_ATTR_IS_CRITICAL] ** [X-ORIGIN]: [MSDN] * Used as [MUST] in: ** * Used [MAY] in: ** !! Allowed [Kerberos Encryption Types] Local [Group Policy Object] Setting In [Windows 7]/[Windows Server 2008 R2], a new [Group Policy Object] setting is introduced for specifying the [encryption] types allowed for [Kerberos]. This is a system wide global setting that will affect all the accounts on the computer where the policy is applied. With this setting, we can enable and disable the encryption/decryption capability of each Crypto system (AES256, AES128, RC4, DES etc). In this way, even an individual [encryption] type is included in the supported encryption type list as we discussed in the last two sections, it will not be selected. The main purpose is to disable [DES] [encryption], which is widely considered not secure enough, in any Windows 7/Windows server 2008R2 computers by default. You may notice that the policy setting “Network Security: Configure Encryption types allowed for [Kerberos]” is “Not Defined” in a new system. When this policy setting is not defined, all Crypto systems except DES will be available for encryption. Users can define this policy setting to enable/disable each individual Crypto system, including DES. !! [Microsoft Management Console] ([MMC]) [MsDS-SupportedEncryptionTypes/MMC-msDS-SupportedEncryptionTypes.png] !! More Information There might be more information for this subject on one of the following: [{ReferringPagesPlugin before='*' after='\n' }] ---- * [#1] - [Windows Configurations for Kerberos Supported Encryption Type|https://blogs.msdn.microsoft.com/openspecification/2011/05/30/windows-configurations-for-kerberos-supported-encryption-type/|target='_blank'] - based on information obtained 2018-05-16-