Share via

ADFS DES disabled

Russell Ang 66 Reputation points
2023-02-16T09:35:43.1266667+00:00

Hi All,

Can anyone advise if the ADFS DES is disabled. And does domain controller or users account need to enable force to use RC4 or AES256 authenticate?

image

We are encounter users authenticate is failed on the adfs.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,913 questions
Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,296 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 36,001 Reputation points
    2023-02-16T16:00:57.7733333+00:00

    Hi @Russell Ang

    Following to value in registry key DES seems enabled in the oprating system of ADFS server.

    In other hand ,the supported encryption for kerberos can be controled by the attribute MS-DS-SupportedEncryptionTypes in computer object and service account where you set the SPN for you ADFS service. It can be also managed by GPO.

    It's recommended to force AES encryption instead of DES and RC4. You should start to disable them on computer client and servers before domain controllers.

    For more details , I invite you to read the following article: Decrypting the Selection of Supported Kerberos Encryption Types

    Please don't forget to mark helpful answer as accepted

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.