Kerberos encryption types - an account persists in using RC4

Question

I enabled RC4, AES128 and AES256 across all enabled computers and users in a domain/forest and now all tickets are encrypted with AES256, except those issued for SQL access. SQL 2016 servers run on Windows 2019 and SQL compatibility level is set to 130. I tried disabling RC4 for accounts running SQL service and SQL reporting service, but the end users kept receiving RC4 tickets and connecting successfully. When I disabled RC4 for the SQL computer, the end users were unable to connect to the SQL server.

Is there something in SQL that needs to be configured for AES to be used for Kerberos ticket encryption?

Thanks
Zoran

Answer 1

The problem was related to old user accounts created in pre-AES AD whose passwords were never reset. 2 password resets, with full AD replication in between, enables AES support.

Answer 2

I did some more testing and managed to eliminate SQL as a possible cause. I created a new gMSA account, registered SQL SPN and used it to run SQL service and SQL agent on a test server. Now when I restricted both gMSA and the server account to AES256, it still worked. So it seems it's something with the old SQL service account which has been around probably since Windows 2000, but it's not the only one from that time, but it's the only one causing this issue.

Replacing this account across the domain is a bit tricky as it has 1000+ SPNs registered, configured Kerberos delegation for dozens of apps etc, so preferred way would be to fix it at this stage.

Is there something in the account's setting that could prevent it from using AES for Kerberos encryption?

Thanks

Answer 3

Hi,
First and foremost, if the server and the computers are in different domain, this behavior is expected as trust by default supports RC4.
If that is the case, you may need to enable AES from trust properties.