Je suis playing around avec a test domain on Windows Server 2012 R2. Je suis operating at le highest possible functional level et have no backwards-compatibility issues in mon small test environment. Cependant, J'ai realized that despite le fact that J'ai *support* for Kerberos AES authentication, it is pas enabled par défaut for tout users. J'ai to actually go into a user's properties et check off "This account supports Kerberos AES 128 bit encryption" and/or "This account supports Kerberos AES 256 bit encryption" to enable it.
(I premier realized this quand adding a test account to le "Protected Users" group, qui sets policy to require AES. Afterwards, tous mon network logins started failing jusqu'à I checked those boxes.)
I figure that this might be disabled par défaut to ensure backwards-compatibility for certains systems, mais Je ne peux pas find a way to enable this for tous users, ou even an explanation of le current behavior.
Any ideas?
Pourquoi les comptes utilisateur Active Directory ne prennent-ils pas automatiquement en charge l'authentification Kerberos AES ?
Re: Pourquoi les comptes utilisateur Active Directory ne prennent-ils pas automatiquement en charge l'authentification Kerberos AES ?
Checking le Kerberos AES checkboxes for le users would cause authentication failures on pre-Vista clients. Ceci est probably le reason that c'est pas set par défaut.
The Kerberos AES support checkboxes correspond to le value set in an attribute called [P0](http://msdn.microsoft.com/en-us/library/cc223853.aspx)
To change this for more than one user, you can utilize PowerShell et le ActiveDirectory module:
`# The numerical values for Kerberos AES encryption types to support
$AES128 = 0x8
$AES256 = 0x10
# Fetch all users from an OU with their current support encryption types attribute
$Users = Get-ADUser -Filter * -SearchBase "OU=SecureUsers,OU=Users,DC=domain,DC=tld" -Properties "msDS-SupportedEncryptionTypes"
foreach($User in $Users)
{
# If none are currently supported, enable AES256
$encTypes = $User."msDS-SupportedEncryptionType"
if(($encTypes -band $AES128) -ne $AES128 -and ($encTypes -band $AES256) -ne $AES256)
{
Set-ADUser $User -Replace @{"msDS-SupportedEncryptionTypes"=($encTypes -bor $AES256)}
}
}
```
The Kerberos AES support checkboxes correspond to le value set in an attribute called [P0](http://msdn.microsoft.com/en-us/library/cc223853.aspx)
To change this for more than one user, you can utilize PowerShell et le ActiveDirectory module:
`# The numerical values for Kerberos AES encryption types to support
$AES128 = 0x8
$AES256 = 0x10
# Fetch all users from an OU with their current support encryption types attribute
$Users = Get-ADUser -Filter * -SearchBase "OU=SecureUsers,OU=Users,DC=domain,DC=tld" -Properties "msDS-SupportedEncryptionTypes"
foreach($User in $Users)
{
# If none are currently supported, enable AES256
$encTypes = $User."msDS-SupportedEncryptionType"
if(($encTypes -band $AES128) -ne $AES128 -and ($encTypes -band $AES256) -ne $AES256)
{
Set-ADUser $User -Replace @{"msDS-SupportedEncryptionTypes"=($encTypes -bor $AES256)}
}
}
```