Active Directory: Kerberos encryption with AES 128

Question

We have added a new support to AES-128 encryption only so our client supports AES 128 only , we cannot add support to AES-256 for some internal reasons, and we are receiving error and incorrect negations due to which domain join and user authentications fails, Please help us with the below first two cases.

Answer 1

Hi there,

You can have a look at the below article which Describes the best practices, location, values, and security considerations for the Network security: Configure encryption types allowed for Kerberos security policy setting.

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos

For the first error a computer in a child domain of an Active Directory Domain Services (AD DS) forest cannot access a service that resides in a different domain within the same forest.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/unsupported-etype-error-accessing-trusted-domain

-----------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--