Enforce Strict Kerberos Encryption Types via Regedit

Enforcing strict Kerberos encryption types ensures that Windows domain logons only use modern, robust cryptographic algorithms such as AES-128 and AES-256, rather than outdated and vulnerable ciphers like DES and RC4. This guide provides step-by-step instructions on configuring the Windows Registry Editor (Regedit) to restrict the allowed Kerberos encryption types on a system.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

Step 2: Navigate to the Kerberos Parameters Key

In the Registry Editor, navigate through the left sidebar to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

Note: If the Parameters key does not exist under Kerberos, right-click on Kerberos, select New > Key, and name it Parameters.

Step 3: Create or Modify the SupportedEncryptionTypes Value

  1. With the Parameters key selected, look for a DWORD value named SupportedEncryptionTypes in the right pane.
  2. If it does not exist:
    • Right-click an empty space in the right pane.
    • Select New > DWORD (32-bit) Value.
    • Name the new value SupportedEncryptionTypes.
  3. Double-click SupportedEncryptionTypes to edit its value.

Step 4: Configure the Value for Strict Encryption

The SupportedEncryptionTypes value uses a bitmask to define permitted algorithms:

To enforce strict encryption (allowing only AES-128, AES-256, and future encryption types while disabling DES and RC4):

  1. Set the Base to Hexadecimal.
  2. Enter 7FFFFFF8 (or 18 to enforce strictly AES128 and AES256 without the future types flag).
  3. Click OK.

Step 5: Apply the Changes

For the changes to take full effect across local services and the security subsystem, restart the computer.