Settings/Values for DefaultDomainSupportedEncTypes etc.

Question

I am trying to set our domain to AES128, AES256 (and future…) encryptions for Kerberos only.

Mostly the recommended values for DefaultDomainSupportedEncTypes, SupportedEncryptionTypes, msDS-SupportedEncryptionTypes are 0x18.

If I follow https://learn.microsoft.com/de-de/openspecs/windows_protocols/ms-kile/6cfc7b50-11ed-4b4d-846d-6f08f0812919 and would like to enable FAST etc. then I would compute 0x0f0018.

Looking at other sources and looking up the value that the GPO "Network security: Configure encryption types allowed for Kerberos" sets, I encounter 0x7ffffff8 .

Which values would you recommend, for which setting (DefaultDomainSupportedEncTypes, SupportedEncryptionTypes, msDS-SupportedEncryptionTypes)?

Best regards,
Michael

Answer 1

Dear @risolis ,

Thanks again for your quick answer.

Yes, I am aware of theese articles. That's where my questions arose from.
Here they state, that the value of DefaultDomainSupportedEncTypes is set to 0x27. But following the very below linked page, it could have been also 0x000f 0027. And if I enable the GPO "encryption types allowed for Kerberos" to (DES-CBC-CRC + DES-CBC-MD5 + RC4-HMAC + future) than the registry value of SupportedEncryptionTypes would be 0x7fff ffe7.

Answer 2

Hi @risolis ,

there is not stated what I am looking for.

Maybe someone from Mircosoft developing this systems can have a lock?

Best,
Michael

Answer 3

Hello @Masuch, Michael

Thank you for sharing this question on this community space.

After reading your case scenario description, I am wondering if you have reviewed the following info...

https://support.microsoft.com/en-gb/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

https://dirteam.com/sander/2022/11/08/spend-some-time-on-properly-configuring-and-monitoring-your-domain-controllers-this-patch-tuesday/

https://borncity.com/win/2022/11/10/updates-for-windows-nov-2022-changes-in-netlogon-and-kerberos-protocol-causing-issues/

I hope you can find this useful to overcome your concern.

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 4

Hi @Masuch, Michael

I was taking a look at this concern from IANA documentation, and I was able to find the same cipher suites stated by you, but it seems to be deprecated as mentioned down below:

DES-CBC-CRC/DES-CBC-MD5/RC4-HMAC

https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 5

Hello @Masuch, Michael

Thank you for that finding.

Did you go over those docs as well?

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/6cfc7b50-11ed-4b4d-846d-6f08f0812919

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/e20ebc4e-5285-40ba-b3bd-ffcb81c2783e

Looking forward to your feedback,

Cheers!