AES 256 Tick or Legacy in AD Users Account Tab

[k-strider]

I ran a knowbe4 Password Exposure Test https://www.knowbe4.com/password-exposure-test

it came back with All Accounts AES Encryption not Set which is these boxes and classes the accounts as Vulnerable

and its correct i ticked the box on a test user and the user still logs in fine. so i was wondering if i should be setting it but that got me googling and well i cant work out if it is needed or if this is Legacy and because the DCs are all 2022 and the Forest and domain function levels are as high as they can be 2016

i ran klist and all the Kerberos certificates are AES-256-CTS-HMAC-SHA1-96 on myself (boxes not ticked) and the test user that i switched this flag on for.

is it something i should enable? odd that still bydefault for new users its not on.

 

On the plus side only one member of staff came back with "week" password. and no breached passwords in use :-)

 

Edit - i would have though if it was important PingCastle would have flagged it up

Edited April 18, 2024 by k-strider