Enabled AES Encryption via Group Policy

Question

When enabling AES encryption on user accounts, do I need to update the Default Domain Policy or the Default Domain Controller Policy or both?

Answer 1

Hello,

When you enable AES encryption for user accounts, you typically update the Default Domain Policy instead of the Default Domain Controller Policy. This is because AES encryption is primarily concerned with authentication and encryption requirements for user and computer accounts in a domain, which are typically enforced through domain policies.

The Default Domain Controller Policy applies primarily to the domain controllers themselves. This policy contains some configuration for the domain controllers, but it does not directly affect the behavior of user or computer accounts. Therefore, you typically do not need to modify the Default Domain Controller Policy when you enable AES encryption.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.