RC4-ADAssessment Module — Quick Start Guide

Install with Install-Module RC4-ADAssessment or import from a local build. For migration from standalone v2.x scripts, see README.md.

🔐 Using with Active Directory

Prerequisites

PowerShell 5.1 or later (7+ for parallel forest assessment)
Active Directory PowerShell module (RSAT-AD-PowerShell)
Group Policy PowerShell module (GPMC)
Domain Admin or equivalent permissions
Network access to domain controllers (WinRM 5985 or RPC 135)

Install & Import

# Install from PSGallery (once published)
Install-Module -Name RC4-ADAssessment

# Or import from local build
Import-Module ./output/builtModule/RC4-ADAssessment

Quick Scan (Fastest - No Event Logs)

Invoke-RC4Assessment

Runtime: ~30 seconds Checks: DCs, GPOs, Trusts, KRBTGT, Service Accounts (incl. dMSA), DES flags, Missing AES keys (explicit non-AES + old passwords), RC4 exceptions, AzureADKerberos detection

Deep Scan (Extended Account Coverage)

Invoke-RC4Assessment -DeepScan

Runtime: ~1-2 minutes Checks: All of the above + RC4-exception and DES-enabled user accounts without SPNs + all computer accounts (excluding DCs) for RC4/DES configurations

Note: The standard scan already detects RC4-only and DES-only accounts (all account types, with or without SPNs). -DeepScan adds detection for accounts that have both RC4 and AES configured (RC4-exception/DES-enabled users without SPNs) and all computer accounts (OS-default 0x1C vs non-default). Combine with -AnalyzeEventLogs for maximum coverage.

Full Assessment (Recommended)

Invoke-RC4Assessment -AnalyzeEventLogs -EventLogHours 24

Runtime: 2-5 minutes Checks: Quick scan + KDC registry, KDCSVC events (CVE-2026-20833), audit policy, Security event logs (4768/4769)

Maximum Coverage

Invoke-RC4Assessment -DeepScan -AnalyzeEventLogs -EventLogHours 168 -ExportResults

Runtime: 3-10 minutes Checks: Everything — deep account scan + 7 days of event logs + full remote DC analysis

With Export

Invoke-RC4Assessment -AnalyzeEventLogs -ExportResults

Output: JSON and CSV files with timestamp in .\Exports\

With Full Reference Manual

Invoke-RC4Assessment -IncludeGuidance

Shows: Audit setup, SIEM/Splunk queries, KRBTGT rotation guidance, July 2026 timeline

Specific Domain

Invoke-RC4Assessment -Domain contoso.com -AnalyzeEventLogs

Specific Domain — Full Assessment with Export & Guidance

Invoke-RC4Assessment -Domain contoso.com -AnalyzeEventLogs -ExportResults -IncludeGuidance

Runtime: 2-5 minutes Output: JSON, CSV, and guidance text files in .\Exports\ + reference manual displayed

Forest-Wide Assessment

# Quick scan all domains in forest
Invoke-RC4ForestAssessment

# Full assessment with event logs
Invoke-RC4ForestAssessment -AnalyzeEventLogs -ExportResults

# Parallel processing (PowerShell 7+)
Invoke-RC4ForestAssessment -Parallel -MaxParallelDomains 5 -AnalyzeEventLogs

Runtime: Varies (parallel mode processes multiple domains concurrently) Output: Per-domain JSON exports + forest-wide summary

Compare Two Runs (Track Progress)

Invoke-RC4AssessmentComparison -BaselineFile before.json -CurrentFile after.json -ShowDetails

Compares: DC encryption, trusts, accounts (KRBTGT, service accounts, DES flags, missing AES keys), KDC registry, KDCSVC events (CVE-2026-20833), event log tickets

📊 Sample Output

Successful Quick Scan

================================================================================
DES/RC4 Kerberos Encryption Assessment v4.4.0
================================================================================

Domain Controller Encryption Configuration
────────────────────────────────────────────────────────────────
ℹ️  Found 3 Domain Controller(s)
✅ All Domain Controllers have AES encryption configured

KRBTGT & Service Account Encryption Assessment
────────────────────────────────────────────────────────────────
✅ KRBTGT password age: 21 days
✅ No accounts with USE_DES_KEY_ONLY flag
✅ No service accounts with RC4/DES-only encryption
✅ No accounts found with potentially missing AES keys

KDC Registry Configuration Assessment
────────────────────────────────────────────────────────────────
ℹ️  DefaultDomainSupportedEncTypes: Not set (uses OS defaults)
⚠️  RC4DefaultDisablementPhase not set
   Deploy January 2026+ security updates, then set to 1 (checkpoint) before enabling Enforcement (value 2)

KDCSVC System Event Assessment (CVE-2026-20833)
────────────────────────────────────────────────────────────────
✅ No KDCSVC events found - no RC4 risks detected (CVE-2026-20833)
  Note: KDCSVC events are logged by the January 2026+ security update regardless of RC4DefaultDisablementPhase

Trust Encryption Assessment (Post-November 2022 Logic)
────────────────────────────────────────────────────────────────
ℹ️  Found 1 trust(s)
✅ Trust 'partner.com': Uses AES by default (msDS-SupportedEncryptionTypes not set)

Overall Security Assessment
────────────────────────────────────────────────────────────────
⚠️  Security warnings detected - remediation recommended

  Recommendations & Remediation:
    • WARNING: [contoso.com] RC4DefaultDisablementPhase not set
      # Step 1: Deploy January 2026+ security updates on all DCs
      # Step 2: Set RC4DefaultDisablementPhase to 1 (administrative checkpoint before enforcement):
      PS> Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters' `
            -Name 'RC4DefaultDisablementPhase' -Value 1 -Type DWord
      PS> Restart-Service Kdc
      # Step 3: Monitor KDCSVC events 201-209 (logged automatically after installing the security update)
      # Step 4: When audit events are clear, enable Enforcement mode (value 2)

  💡 Tip: Use -IncludeGuidance for the full reference manual

Event Log Analysis with RC4 Detection

Kerberos Audit Policy Verification
────────────────────────────────────────────────────────────────
✅ Kerberos auditing is enabled (Authentication Service + Ticket Operations)

Event Log Analysis - Actual DES/RC4 Usage
────────────────────────────────────────────────────────────────
ℹ️  Querying event logs from 3 Domain Controller(s)...
  • DC01... ✅ 12,543 events
  • DC02... ✅ 11,892 events
  • DC03... ❌ RPC server unavailable

❌ RC4 tickets detected in active use!
  RC4 accounts: LEGACY-APP$, SQL2008-SRV$

  Recommendations & Remediation:
    • CRITICAL: [contoso.com] RC4 tickets detected (8 tickets,
        accounts: LEGACY-APP$, SQL2008-SRV$)
      # For each account using RC4, try AES first:
      PS> Set-ADUser '<AccountName>' -Replace @{
            'msDS-SupportedEncryptionTypes'=0x18}
      PS> Set-ADAccountPassword '<AccountName>' -Reset; klist purge
      # If AES fails, add explicit RC4 exception (CVE-2026-20833 safe):
      #   -Replace @{'msDS-SupportedEncryptionTypes'=0x1C}
      #   0x1C = RC4 + AES128 + AES256

Event Log Access Failures

  ⚠  Event Log Query Failures:
  2 Domain Controller(s) could not be queried for event logs

  • DC01.contoso.com: The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
  • DC03.contoso.com: Access is denied. Attempted to perform an unauthorized operation.

  🔧 How to fix remote event log access issues:

  Option 1: Enable WinRM (Recommended)
  ────────────────────────────────────────
  Run on each failed DC:
  PS> Enable-PSRemoting -Force
  PS> Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force
  PS> Restart-Service WinRM

  Option 2: Configure Firewall for RPC
  ────────────────────────────────────────
  Required ports:
  - TCP 135 (RPC Endpoint Mapper)
  - TCP 49152-65535 (Dynamic RPC ports)

  Windows Firewall rule:
  PS> Enable-NetFirewallRule -DisplayGroup 'Remote Event Log Management'

  Option 3: Run Locally on DC
  ────────────────────────────────────────
  Import module on DC and run:
  PS> Import-Module RC4-ADAssessment
  PS> Invoke-RC4Assessment -AnalyzeEventLogs -EventLogHours 24

  Option 4: Verify Permissions
  ────────────────────────────────────────
  Add your account to 'Event Log Readers' group on DCs:
  PS> Add-ADGroupMember -Identity 'Event Log Readers' -Members 'YourAccount'

Summary Tables

At the end of every assessment, you'll see comprehensive summary tables:

Assessment Summary Tables
────────────────────────────────────────────────────────────────

  DOMAIN CONTROLLER SUMMARY
  ────────────────────────────────────────────────────────────────
  
  Domain Controller  Status   Encryption Types       GPO Status  Operating System
  -----------------  ------   ----------------       ----------  ----------------
  DC01.contoso.com   OK       AES128-HMAC, AES256    OK          Windows Server 2022
  DC02.contoso.com   WARNING  RC4-HMAC, AES128       WARNING     Windows Server 2019
  DC03.contoso.com   CRITICAL DES-CBC-MD5, RC4       CRITICAL    Windows Server 2016

  Summary:
    Total DCs: 3
    DES Configured: 1
    RC4 Configured: 1
    AES Configured: 1


  EVENT LOG ANALYSIS SUMMARY
  ────────────────────────────────────────────────────────────────
  
  Domain Controller  Status   Events Analyzed  RC4 Tickets  DES Tickets
  -----------------  ------   ---------------  -----------  -----------
  DC01.contoso.com   Success  12,543           0            0
  DC02.contoso.com   Success  11,892           5            0
  DC03.contoso.com   Failed   0                0            0

  Summary:
    Total Events Analyzed: 24,435
    RC4 Tickets Detected: 5
    Failed DC Queries: 1

Color Coding:

🟢 Green - OK/Success status
🟡 Yellow - WARNING status
🔴 Red - CRITICAL/Failed status

Forest-Wide (when using Invoke-RC4ForestAssessment): Tables are grouped by domain, showing all DCs, event logs, and trusts across the entire forest.

📊 Understanding the Results

Overall Status

🟢 OK - No DES/RC4 usage detected, environment is ready for July 2026
🟡 WARNING - RC4 detected, should be removed before July 2026 deadline
🔴 CRITICAL - DES detected or active RC4 usage in event logs

Domain Controllers

AES Configured - DCs with AES encryption (good)
RC4 Configured - DCs allowing RC4 (warning - inline fix command provided)
DES Configured - DCs allowing DES (critical - remove immediately)
Not Configured (GPO Inherited) - DCs getting settings from GPO (normal)

KRBTGT & Service Accounts (v2.2.0+)

KRBTGT Password Age - Should be rotated regularly (guidance provided)
Linux Keytab Impact - KRBTGT or service account password rotation invalidates Kerberos keytab files; Linux services (Apache, SSSD, Samba, PostgreSQL, etc.) must regenerate keytabs after rotation
USE_DES_KEY_ONLY - Accounts with this UAC flag need remediation
RC4/DES-only SPN Accounts - Service accounts missing AES (fix commands shown)
gMSA/sMSA - Managed service accounts reviewed for weak encryption
Stale Passwords - Service accounts >365 days old with RC4 enabled

KDC Registry (v2.3.0+)

DefaultDomainSupportedEncTypes - OS-level encryption defaults
RC4DefaultDisablementPhase - Set to 1 (checkpoint), then 2 (Enforce) per CVE-2026-20833. KDCSVC audit events are logged after installing the security update regardless of this value.

KDCSVC System Events (v2.4.0+)

Events 201-209 - KDCSVC events in System log indicating RC4 risks (CVE-2026-20833)
Logged by the January 2026+ security update regardless of RC4DefaultDisablementPhase
Events 201-203: Audit warnings (RC4 requested for default accounts)
Events 206-208: Enforcement blocks (RC4 blocked in Enforcement mode)

Missing AES Keys (v2.3.0+, improved in v4.4.0)

Detected via two paths in the standard scan (no -DeepScan needed):

Path A — msDS-SupportedEncryptionTypes explicitly set to a non-zero value without AES bits (e.g., 0x4 = RC4-only). These accounts are configured for RC4-only/DES-only ticket negotiation. Path A also considers password age — accounts whose password was set after DFL 2008 have AES keys regardless of this attribute (it controls negotiation, not key storage)
Path B — msDS-SupportedEncryptionTypes not set (null/0) AND password predates the domain's AES threshold (DFL 2008 upgrade date, detected via "Read-only Domain Controllers" group creation). These accounts may never have had AES keys generated

Since v4.4.0, RC4-only and DES-only accounts are caught by the standard scan. -DeepScan is no longer needed for these — it now focuses on RC4-exception/DES-enabled users without SPNs and computer account scanning.

AzureADKerberos (v2.5.0+)

Entra Kerberos proxy object in DC OU is auto-detected and excluded from DC counts
Separate informational display in summary tables and exports
Its krbtgt keys are not auto-rotated — rotate regularly using Set-AzureADKerberosServer -Domain <domain> -CloudCredential $cloudCred -DomainCredential $domainCred -RotateServerKey (requires AzureADHybridAuthenticationManagement module)
Key rotation invalidates Kerberos keytab files for Linux services — regenerate keytabs after rotation

RC4 Exception Accounts (v2.6.0+)

Accounts with explicit RC4 + AES (0x1C) flagged as WARNING
AES-first hardening: default fix commands now use 0x18 (AES-only)
0x1C recommended only as last resort when AES breaks an application

DES-Enabled Accounts (v2.5.1+)

Accounts with DES bits set alongside AES are flagged as WARNING (DES removed in Server 2025)
Covers SPN user accounts, gMSA, sMSA, and dMSA

Trusts (Post-November 2022 Logic)

AES Default (not set) - Trusts with no msDS-SupportedEncryptionTypes (✓ secure)
AES Explicit - Trusts with AES explicitly configured (✓ secure)
RC4 Risk - Trusts with RC4 enabled (⚠ remove before July 2026)
DES Risk - Trusts with DES enabled (🔴 critical)

Event Logs (Most Important!)

Audit Policy - Script verifies Kerberos auditing is enabled before querying
AES Tickets - Kerberos tickets using AES (✓ expected)
RC4 Tickets - Active RC4 usage (⚠ investigate clients)
DES Tickets - Active DES usage (🔴 critical - legacy systems)

Inline Remediation Commands (v2.3.0+)

Every finding includes copy-paste PowerShell commands to fix the issue, including klist purge for cache clearing.

🚀 Migration Path (Preparing for July 2026)

Phase 1: Discovery (DCs, trusts, service accounts, logs)

Invoke-RC4Assessment -AnalyzeEventLogs -ExportResults

Focus on the highest-risk items first: DCs, trusts, KRBTGT, service accounts, KDC registry, KDCSVC events, and event logs. No -DeepScan yet — avoid drowning in bulk account findings before critical items are fixed.

Phase 2: Remediate (high-risk items)

Follow the inline fix commands shown with every finding:

Set-ADComputer / Set-ADUser for DC and service account encryption types
Set-ItemProperty for KDC registry keys (RC4DefaultDisablementPhase)
Set-ADAccountPassword + klist purge for accounts that may lack AES keys (migrated or pre-DFL-2008 password — a single reset generates AES keys on DFL ≥ 2008)

Phase 3: Validate

Invoke-RC4Assessment -AnalyzeEventLogs -ExportResults
Invoke-RC4AssessmentComparison -BaselineFile before.json -CurrentFile after.json -ShowDetails

Compare assessments to confirm all critical items are resolved before moving on.

Phase 4: Deep Sweep (all users + computers)

Invoke-RC4Assessment -DeepScan -AnalyzeEventLogs -ExportResults

Now scan all enabled user accounts and computer accounts for remaining RC4/DES configurations.

Phase 5: Final Remediate (bulk cleanup)

Password resets for remaining accounts with missing AES keys
Address any non-default computer account encryption configs

Phase 6: Final Validate

Invoke-RC4AssessmentComparison -BaselineFile deep-before.json -CurrentFile deep-after.json -ShowDetails

Confirm everything is clean. Repeat Phase 5–6 as needed.

Ongoing: Monitoring Setup

Invoke-RC4Assessment -IncludeGuidance

Get Splunk/SIEM queries, KRBTGT rotation guidance, and continuous monitoring setup.

🆘 Troubleshooting

Event Log Access Issues

Problem: Module shows "RPC server unavailable" or "Access denied" when querying DCs

Solution: The module provides automatic troubleshooting guidance. When failures occur, you'll see:

Which DCs failed and the specific error
Four detailed options to fix the issue
PowerShell commands to run

"Cannot find Active Directory module"

Solution: Install RSAT tools or run on domain controller

# Windows 10/11
Get-WindowsCapability -Name RSAT.ActiveDirectory* -Online | Add-WindowsCapability -Online

# Windows Server
Install-WindowsFeature RSAT-AD-PowerShell

"Access Denied" when querying DCs

Solution: Run PowerShell as Domain Admin or user with appropriate permissions

"Cannot connect to domain"

Solution: Verify network connectivity and DNS resolution

Test-Connection -ComputerName your-dc-name
Resolve-DnsName your-domain.com

Child Domain Issues

Problem: Errors when running against child domains

Solution: Use both -Domain and -Server parameters:

Invoke-RC4Assessment -Domain child.contoso.com -Server DC01.child.contoso.com -AnalyzeEventLogs

Emojis not displaying correctly

Solution: Uses UTF-8 encoding and compatible Unicode characters for PowerShell 5.1

Script runs very slowly

Solution: Run without -AnalyzeEventLogs to skip remote DC queries

Invoke-RC4Assessment

📚 Additional Resources

README.md — Comprehensive documentation with full sample outputs and July 2026 timeline
CHANGELOG.md — Full version history
archive/README_v1_LEGACY.md — Legacy v1.0 documentation (archived)
KB5021131 — Managing Kerberos protocol changes
Detect and Remediate RC4 — Microsoft guidance
Microsoft Kerberos-Crypto — Microsoft's Kerberos crypto scripts

🎯 What's New in v4.4.0

Missing AES Keys detection rewritten — Two-path approach: Path A detects explicit non-AES encryption (e.g., RC4-only), Path B detects unset attributes with old passwords. Standard scan now catches RC4-only/DES-only accounts without -DeepScan.
KDCSVC note corrected — Events are logged regardless of RC4DefaultDisablementPhase (the phase controls enforcement, not logging).

For the complete version history, see CHANGELOG.md.

🔄 Common Workflows

Workflow 1: Quick Domain Health Check (1 minute)

# Single command for domain readiness
Invoke-RC4Assessment

# Expected output includes:
# ✅ All Domain Controllers have AES encryption configured
# ✅ KRBTGT password age: 21 days
# ✅ No service accounts with RC4/DES-only encryption
# ✅ Trusts use AES by default
# ℹ️  Remote DC analysis skipped. Use -AnalyzeEventLogs to enable.

Workflow 2: Deep Account Scan (1-2 minutes)

# Scan all user and computer accounts for RC4/DES issues
Invoke-RC4Assessment -DeepScan

# Note: This does NOT query event logs or remote DC registries.
# For full coverage, combine both switches:
Invoke-RC4Assessment -DeepScan -AnalyzeEventLogs -EventLogHours 168 -ExportResults

Workflow 3: Deep Event Log Analysis (5 minutes)

# Analyze 7 days of actual usage across ALL DCs
Invoke-RC4Assessment -AnalyzeEventLogs -EventLogHours 168 -ExportResults

# Script auto-discovers all DCs and shows per-DC results:
# • Querying DC01.contoso.com...
#   ✓ Retrieved 15,234 events from DC01.contoso.com
# • Querying DC02.contoso.com...
#   ✓ Retrieved 12,456 events from DC02.contoso.com
# • Querying DC03.contoso.com...
#   ✗ RPC/Network error on DC03.contoso.com

Workflow 3: Multi-Domain Forest Assessment (10-15 minutes)

# Assess all domains in forest with parallel processing
Invoke-RC4ForestAssessment -AnalyzeEventLogs -ExportResults -Parallel -MaxParallelDomains 3

# Forest output shows per-domain DC discovery and assessment results

Workflow 4: Child Domain with Connectivity Issues (3 minutes)

# Problem: Auto-discovery fails for child domain
Invoke-RC4Assessment -Domain labs.contoso.com -AnalyzeEventLogs

# Solution: Specify a known DC
Invoke-RC4Assessment -Server DC01.labs.contoso.com -AnalyzeEventLogs

Workflow 5: Track Remediation Progress (5 minutes per run)

# Week 1: Baseline
Invoke-RC4Assessment -AnalyzeEventLogs -EventLogHours 168 -ExportResults

# Week 2: After fixes
Invoke-RC4Assessment -AnalyzeEventLogs -EventLogHours 168 -ExportResults

# Compare
Invoke-RC4AssessmentComparison -BaselineFile old.json -CurrentFile new.json -ShowDetails

💡 Pro Tips

Start with a quick scan - Run Invoke-RC4Assessment for quick results, then add -DeepScan for full account coverage, and -AnalyzeEventLogs for remote DC analysis
Use Forest Assessment for multi-domain environments - Assess-ADForest.ps1 automates domain enumeration
Enable parallel processing - Use -Parallel with PowerShell 7+ for faster forest assessments
Monitor for 7+ days - Use -EventLogHours 168 to capture weekly activity patterns
Track progress with Compare-Assessments - Export baseline, remediate, export again, then compare
Deploy January 2026 updates - Set RC4DefaultDisablementPhase = 1 on all DCs (administrative checkpoint before enforcement)
Export results - Keep historical data for compliance/auditing (saved to .\Exports folder)
Include guidance - -IncludeGuidance shows audit setup, SIEM queries, KRBTGT rotation, July 2026 timeline
Use -Server for child domains - Specify a known DC when auto-discovery fails
Copy-paste fix commands - Every finding now includes inline remediation commands

✅ Validation Checklist

When you have AD access:

FilesExpand file tree

QUICK_START.md

Latest commit

History