MC1279830 — Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update

Windows updates released April 2026 and later begin the second deployment phase of protections for a Kerberos information disclosure vulnerability (CVE‑2026‑20833). In this phase, domain controllers change default Kerberos ticket behavior for accounts that do not have an explicit Kerberos encryption configuration, shifting to AES‑SHA1-only by default. Environments with remaining RC4 dependencies may experience authentication issues unless those dependencies are remediated or explicitly configure...

Open in Message Center Email this update View in the live feed