Microsoft to Kill RC4 in Kerberos by 2026

Microsoft is officially moving to shut the door on RC4 – a legacy cryptographic cipher that has quietly persisted inside Windows authentication environments for decades – and forcing organizations to finally reckon with outdated security decisions embedded into modern identity systems.

See Also: ‘No One-Size-Fits-All’ Solution to Resilience and Recovery

The tech giant recently announced plans to disable RC4 by default in Windows Kerberos, a change that will directly impact how domain controllers authenticate users and services across enterprise and government networks. The update is expected to roll out in stages, according to Microsoft, giving operators time to identify and remediate their lingering dependencies.

By mid-2026, Microsoft will update default settings for the Kerberos key distribution center on Windows Server 2008 and later to allow only stronger AES-SHA1 encryption, wrote Matthew Palko, a principal program manager at the company. RC4 will be turned off by default and will only be used if a domain administrator explicitly configures an account or the KDC to permit it.

Analysts said the move signals one of Microsoft’s most significant cryptographic cleanups in years. RC4 has long been considered obsolete, but remained enabled largely for compatibility reasons, particularly in older domains where legacy systems or service accounts quietly relied on weaker encryption.

Kenneth Paterson, a professor of information security at ETH Zurich, said legacy cryptographic algorithms often persist not because they are trusted, but because they become embedded in older software stacks that are too difficult or costly to modernize.

Paterson said the phenomenon – often described as “ossification” – highlights the growing importance of crypto agility, which is the ability for systems to transition away from outdated algorithms in a controlled way without introducing new security or operational risks. He added that while RC4’s weaknesses are well-documented, removing it is unlikely to dramatically shift the threat landscape on its own, particularly outside of environments where it has not been previously deployed or exploitable.

Security teams have warned for years that legacy cryptography creates uneven defenses inside Active Directory environments, where Kerberos can negotiate weaker encryption types if stronger options are unavailable or misconfigured. Those inconsistencies have repeatedly been exploited by attackers targeting identity infrastructure (see: Ransomware Hackers Target Active Directory Domain Controllers).

RC4’s continued presence in Kerberos has been particularly problematic in large Windows domains, analysts told Information Security Media Group, where service accounts, trust relationships or forgotten configurations can quietly fall back to weaker encryption. Attackers have learned to probe for those weak points rather than attempting to defeat stronger controls head-on.

In real-world intrusions, threat actors have used RC4-enabled Kerberos flows to crack service account passwords offline and move laterally across networks, often while evading detection and without triggering alerts tied to endpoint or perimeter defenses. Those techniques have helped shift attacker focus toward identity systems as a primary target (see: Why Active Directory’s 25-Year Legacy Is a Security Issue).

Microsoft will allow administrators to re-enable RC4 in limited scenarios to prevent sudden outages – but analysts warn that exceptions can quickly become permanent if organizations treat them as a safety net rather than a temporary bridge.