As of this writing, July 2026 Windows Server patching has raised concerns for many administrators and organizations. The reason is the fact that this patch may cause issues with RC4 with no rollback capability. If you work for an environment that has a lot of legacy service accounts and systems, some possibly going back to Windows NT, you may be holding off on applying the July 2026 patches on your domain controllers. No one wants to have things come to a grinding halt due to an authentication failure of a critical service account password. Due to this issue, I recently dug into the issue to determine the potential impact and resolution.
First, Microsoft does provide some tools to check the accounts in your active directory. In my opinion, the List_Accounts.ps1 PowerShell Script is the most useful. This script and others are discussed in the Microsoft Learn article link below as well as the link to the GitHub repositor where they can be downloaded:
Detect and Remediate RC4 Usage in Kerberos | Microsoft Learn
I modified the PowerShell script to export to a .CSV file and opened it in Excel. This gives you a file with five headers. Next, perform a custom sort based on the “Keys” header. From this sorted list, I deleted all lines except the ones where the “Keys” column was either blank or had RC4. These are the accounts of most concern. To address these, the recommendation is to change the account AD attribute “msDS-SupportedEncryptionTypes” to the value of “28”. Making this change still caused concern as usually service accounts may be used on numerous systems, and making this change could require the password to be reset. With this in mind, I opened a MS support case to discuss the potential best resolution to avoid as much interruption as possible.
In my conversation with support, the engineer pointed out that the accounts that have RC4 will not stop working. He said this is a common misconception about the update. However, the issue is more with the accounts that are blank in the output. These have no fallback encryption and will fail after the July 2026 security patch. The recommendation was to start with a test account or something less critical like a DEV account. Change the Microsoft attribute to 28. Reboot a workstation or server that uses that account, then try to connect. Generally, this should not cause an issue. However, if it fails, the password may need to be reset as this will re-encrypt the password and update the hash value in AD. The password can be reset to the same password (if it meets the current password restrictions), saving the problem of having to go to numerous systems and enter a new password. Saving a lot of work for administrators.
Leave a Reply