RC4-ADAssessment

Author(s)

• Jan Tiedemann

Tags

ActiveDirectory Kerberos RC4 DES AES Encryption Security Assessment Remediation

Functions

Invoke-RC4Assessment Invoke-RC4AssessmentComparison Invoke-RC4ForestAssessment

Dependencies

This module has no dependencies.

Release Notes

## [5.2.0-preview0001] - 2026-11-02

### Changed

- Microsoft RC4 enforcement (July 2026) is no longer described as upcoming in the
 README, QUICK_START, both FAQs, the module description and the guidance text.
 Timeline: audit Jan 2026, enforcement with rollback Apr 2026, enforcement only
 from the July 2026 update, with a pointer to verify against KB5073381.
- Get-KdcRegistryAssessment: `RC4DefaultDisablementPhase` values are reported as
 legacy (only honored on DCs without the July 2026+ update); "not set" is the
 expected state and no longer raises a warning or a "set to 1" recommendation.
- Invoke-RC4Assessment: only the legacy rollback value 0 produces a recommendation
 (remove the stale key, use per-account exceptions instead).
- Forest assessment and recommendation texts no longer refer to a future deadline.
- Guidance: KDCSVC events 203/204/208/209 are described as now-blocked requests.