ADFS DES disabled

Question

ADFS DES disabled

Russell Ang 66

Hi All,

Can anyone advise if the ADFS DES is disabled. And does domain controller or users account need to enable force to use RC4 or AES256 authenticate?

We are encounter users authenticate is failed on the adfs.

1 answer

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi @Russell Ang

Following to value in registry key DES seems enabled in the oprating system of ADFS server.

In other hand ,the supported encryption for kerberos can be controled by the attribute MS-DS-SupportedEncryptionTypes in computer object and service account where you set the SPN for you ADFS service. It can be also managed by GPO.

It's recommended to force AES encryption instead of DES and RC4. You should start to disable them on computer client and servers before domain controllers.

For more details , I invite you to read the following article: Decrypting the Selection of Supported Kerberos Encryption Types

Please don't forget to mark helpful answer as accepted

Russell Ang 66 Reputation points

2023-02-17T07:42:13.1366667+00:00

@BOURBITA Thameur,

Per my understanding which this registry value is enabled with RC4 & AES encryption.
Thameur-BOURBITA 36,261 Reputation points Moderator

2023-02-17T09:26:50.52+00:00

Hi @Russell Ang

Yes.

This registry key should be created automatically when you set supported encrytion type through GPO.

From the gpo report , you can check if there is any GPO control the list of supported encryption type in the ADFS server:

gpresult /H c:\temp\gpresult.html

Please don't forget to mark helpful answer as accepted

Share via

ADFS DES disabled

1 answer

Your answer