Breaking Things, Explaining Why
Unpopular opinions, real-world findings, and the kind of advice that might get me uninvited from vendor dinners.
Your Active Directory Authentication Might Break in April 2026 - Here's How to Prevent It
TL;DR: Microsoft is killing RC4 encryption in Kerberos. Starting April 2026, accounts that haven’t had their password changed since the Windows 2008 era will stop authenticating. If you’re running XP or Server 2003 - yes, I know some of you still are - those machines will completely stop talking to your domain. This article tells you how to check if you’re affected and exactly what to do about it. The Short Version Microsoft announced that starting April 2026, the default encryption for Kerberos will change from RC4 to AES. If any of your accounts - service accounts, user accounts, computer accounts - don’t have AES encryption keys stored in AD, authentication will fail. ...