Server 2019 DC - Kerberos RC4

[AndySummers]

We have recently promoted a 2019 Server to be a domain controller but it won't authenticate access to our EMC VNX datastore which we believe only supports RC4 Kerberos - is there anyway to enable RC4 Kerberos in Server 2019 as it appears to have been removed?

 

(Using the IIS Crypto tool we can see the 2019 server does not have any RC4 ciphers)

 

Access to the EMC VNX datastore works from 2012 and 2016 DC's.

Access from the 2019 server to all other devices on the network also work (we can see these using AES encryption via the klist utility)

 

I can see no documentation suggesting any changes around Kerberos in server 2019

[Rafter]

Hi - did you ever get a resolution to this, we have the same issue!

[luisnyc]

See here

https://www.dell.com/support/kbdoc/en-us/539069

 

Bug with the VNX software.

[aleinss]

Hi Luisnyc, can you do me a kindness and post the contents of that URL since don't have a Dell account? Just curious what it says. I think our solution is going to be to demote the new DCs I put up as 2019 and rebuild them as 2016. We haven't had maintenance on the VNXs since 2016 and we should have got rid of them 4 years ago, but here we are (I just started here last year).

[Josh87]

Hi, for anyone that finds this thread and needs to understand what's failing here. This issue with VNX is a limitation by design, or perhaps a bug as stated by luisnyc, issue which you can read more about in this Dell article: https://www.dell.com/support/kbdoc/en-us/539069

 

If you don't have a Dell account, you can't view the content, but the article basically states that the VNX devices will not accept CIFS connections with Kerberos tickets granted by 2016/2019 Domain Controllers.

 

I personally haven't seen the issue with 2016, only with 2019.

[aleinss]

Thanks Josh87. We demoted our 2019 DCs back to 2016 DCs and problem solved. We are now working overtime to get everything off the VNX over to the Compellent.