Implement AES encryption for user accounts in Active Directory

Question

Hello,

I'm seeking to implement AES encryption for user accounts in Active Directory. My question is whether this can be achieved through Group Policy Objects (GPOs). Based on my research, it appears that Windows Active Directory (AD) does not inherently support direct encryption of individual user accounts using GPOs.

I came across a post where a solution was provided to enable AES for user accounts, but I'm interested in establishing this configuration as a default for any newly created account. Here's the link to the post I referred to:

Link to the Post

Could you please confirm the accuracy of my understanding?

Thank you for your assistance.

Answer 1

May have already happened depending on the patch level. Something here could help.

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/what-happened-to-kerberos-authentication-after-installing-the/ba-p/3696351

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos

--please don't forget to upvote and Accept as answer if the reply is helpful--