Enabling AES 128 and 256 On User Accounts

Question

Our AD environment is running in 2008 R2 forest mode and 2016 domain mode. The domain has been around for a long time and see all accounts even new ones do not have the check boxes selected for AES128 & 256. I enabled this on some accounts for testing but have the following questions.

1. I confirmed RC4 is being used as I see if in the security event logs. Do users need to change their password in order for AES to be used?
2. How can the domain be set so all new accounts have AES enabled by default?
3. The last time the password on our krbtgt account was changed was 2014. Does the AES setting or password need to be changed on this account as well?

Answer 1

1. Do users need to change their password in order for AES to be used? Yes, users need to change their password for AES encryption to take effect. This is because Kerberos tickets are generated based on a hash of the user's password, and the encryption type used for that hash depends on the available encryption types set on the account. If the account is configured to support AES but the password was set while RC4 was still in use, the Kerberos ticket will continue using the RC4 key until the password is reset. Changing the password forces the creation of a new hash that can then use AES encryption.
2. How can the domain be set so all new accounts have AES enabled by default? You can ensure that AES is enabled by default on new accounts by setting the domain's account control flags. Specifically, for all new user accounts, you want the msDS-SupportedEncryptionTypes attribute to include AES. Here's how you can configure this:
   • Set Group Policy: In a Group Policy Object (GPO) that applies to your domain or OU, go to: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Look for Network security: Configure encryption types allowed for Kerberos. Ensure that AES 128-bit and AES 256-bit are selected.
   • Default for New Accounts: Modify the default user account creation process (via a script or workflow) to explicitly set the msDS-SupportedEncryptionTypes attribute to enable AES for new user objects. This can be scripted using PowerShell or during the account provisioning process.
3. Does the AES setting or password need to be changed on the krbtgt account as well? Yes, the krbtgt account's password needs to be changed for AES encryption to take effect. The krbtgt account is responsible for encrypting and decrypting Kerberos tickets, including ticket-granting tickets (TGTs). If the krbtgt password has not been changed since 2014, it would still be using encryption types based on the old password, potentially RC4. Steps to Rotate the krbtgt Password:
   • Change the krbtgt account password twice (it is recommended to change it twice to ensure both the old and new keys are updated properly).
   • Wait for replication to complete.
   • Ensure that AES encryption is enabled on the krbtgt account by setting its msDS-SupportedEncryptionTypes attribute to include AES types (AES128 and AES256).
   After rotating the krbtgt password, new Kerberos tickets will start using AES if the accounts support it. This is crucial because the krbtgt account encrypts the TGTs for all domain accounts.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin