RC4-ADAssessment

Author(s)

• Jan Tiedemann

Tags

ActiveDirectory Kerberos RC4 DES AES Encryption Security Assessment Remediation

Functions

Invoke-RC4Assessment Invoke-RC4AssessmentComparison Invoke-RC4ForestAssessment

Dependencies

This module has no dependencies.

Release Notes

## [4.17.0] - 2026-04-28

### Added

- GPO-vs-AD etype drift detection in `Get-KdcRegistryAssessment` — reads
 `SupportedEncryptionTypes` from the GPO Policies registry path on each DC and
 compares against the DC's `msDS-SupportedEncryptionTypes` AD attribute to detect
 pending Kerberos service restarts or manual overrides (#31)
- Etype drift tracking in `Invoke-RC4AssessmentComparison` — shows drift DC count
 changes between baseline and current assessments (#31)

### Fixed

- `Get-KdcRegistryAssessment` falls back to local registry read when
 `Invoke-Command` fails on the DC the tool is running on (loopback WinRM
 cold-start issue)
- GPO `SupportedEncryptionTypes` value `0x80000018` (2147483672) caused
 `Int32` overflow — now uses `[long]` before stripping the high bit
- Local fallback and remote DC failure messages now show the actual error
 for diagnostics