TL;DR: July 14, 2026 is Microsoft's Kerberos RC4 hardening enforcement date, delivered as the second phase of the KB5052916 rollout that began in November 2025. On that date, domain-joined Windows systems move from "audit" to "enforce" for RC4-HMAC Kerberos ticket rejection. Any NC SMB with a legacy line-of-business app, legacy printer, legacy scanner, or legacy Java/Oracle client that still requests RC4 tickets will see authentication break the moment the July 2026 Patch Tuesday cumulative updates ship. Kerberoasting and AS-REP roasting — two of the most heavily-used credential-theft techniques against 2025-2026 SMB Active Directory environments — depend on RC4. This enforcement closes the door on both. Every NC SMB running Active Directory needs to audit msDS-SupportedEncryptionTypes this week and plan the AES-256 cutover before Patch Tuesday lands.
Key takeaway: The July 14, 2026 Kerberos enforcement is not optional and it is not a "we'll deal with it later" ticket. Domain controllers stop honoring RC4 tickets by default. Every legacy device or app that still requests RC4 fails to authenticate. Audit now, remediate this quarter, or you will spend Patch Tuesday week explaining outages to the CEO.
Are you certain no device on your domain still requests RC4 Kerberos tickets? Contact Preferred Data Corporation for a same-week Active Directory hardening audit. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.
What Is Changing in Active Directory on July 14, 2026?
Microsoft's KB5052916 rollout, first delivered in November 2025 domain controller cumulative updates, introduced a three-phase deprecation of RC4-HMAC Kerberos ticket support. The phases are audit (November 2025), enforcement-by-default (July 14, 2026), and eventual complete removal.
Three specific behavior changes on July 14, 2026:
- Default deny for RC4-HMAC Kerberos tickets. Domain controllers refuse to issue or accept RC4-HMAC tickets unless an object has the RC4 encryption type explicitly permitted via
msDS-SupportedEncryptionTypes. - Trust-scoped enforcement. Cross-domain and cross-forest trusts default to AES-only. Legacy application accounts with unset or default encryption-type attributes fail authentication.
- Audit-log escalation. Failed RC4 attempts move from informational events to warning-level events with expanded field capture, giving MSSP SOC teams the signal they need for kerberoasting detection.
The enforcement lands with the July 2026 Patch Tuesday cumulative updates and cannot be deferred by policy alone. Registry-based overrides remain possible but are officially discouraged and telemetered to Microsoft's Secure Score dashboard.
Key takeaway: Microsoft has been transparent about this enforcement date since November 2025. The industry warning window closed months ago — July 14, 2026 is execution day. NC SMBs with domain controllers on N-1 or N-2 patch levels still land the enforcement when they eventually update.
Why Was RC4-HMAC Kerberos Deprecated?
RC4-HMAC is a 1990s-era stream cipher with well-documented weaknesses that make it the preferred target for two prolific 2025-2026 attack techniques: kerberoasting and AS-REP roasting. Both work by extracting Kerberos tickets from Active Directory and cracking them offline.
Three concrete failure modes RC4 enables:
- Kerberoasting. Any authenticated Active Directory user can request a Kerberos service ticket for any service principal name (SPN). If the account has RC4 permitted, the ticket is issued with RC4-HMAC encryption. The ticket is then extractable and crackable offline at gigahash-per-second rates on commodity GPUs — a strong password can be recovered in hours.
- AS-REP roasting. For accounts with "Do not require Kerberos pre-authentication" set, an anonymous requestor can pull a ticket encrypted with the account's password hash. RC4 encryption of that ticket enables the same offline crack.
- Downgrade attacks. An attacker with a foothold can force RC4 negotiation on tickets that would otherwise use AES, defeating the intent of AES-only policy.
CISA, NSA, and Microsoft have jointly recommended AES-only Kerberos since 2022. The 2025-2026 industry pattern of ransomware groups using kerberoasting-derived credentials for lateral movement — heavily documented in Sophos, CrowdStrike, and Rapid7 mid-year reports — drove Microsoft to move from recommendation to enforcement.
Which Devices and Apps in an NC SMB Are Most at Risk?
The devices and applications most likely to still request RC4 in an NC SMB fall into predictable categories. Any of these on your network is a P0 audit target.
Common RC4-dependent items in NC SMBs:
- Legacy Java applications. JDK 8 (Java 8) with certain vendor-shipped
krb5.conffiles defaults to RC4-HMAC for older TLS clients. Oracle E-Business Suite, older WebLogic deployments, and many custom Java line-of-business apps ship in this posture. - Multi-function printers and scanners. Ricoh, Canon, Xerox, HP LaserJet Enterprise, and Konica Minolta MFPs older than 2022 firmware frequently authenticate SMB scan-to-folder and LDAP address book lookups with RC4-only Kerberos.
- Legacy Linux and Unix hosts. MIT Kerberos before 1.19 defaults to RC4 in mixed environments. AIX, HP-UX, and Solaris shops routinely still have this.
- Older ERP integrations. Pervasive SQL, Actian Zen, custom Delphi clients, and 20+ year old ERP integrations frequently authenticate with RC4.
- Windows Server 2012 R2 and earlier. Still permitted with extended security updates but frequently misconfigured to request RC4 by default.
- Third-party PAM tools. Legacy CyberArk, BeyondTrust, and Thycotic (Delinea) deployments occasionally negotiate RC4 for privileged sessions when the vault was configured before 2022.
For NC manufacturers running Pervasive SQL Actian Zen ERPs, older Delphi client-server apps, and legacy MFPs on the plant floor, the exposure is essentially universal. This is the exact profile Preferred Data has spent 37 years supporting, and we know where the RC4 bodies are buried.
Explore Preferred Data's managed IT services
How Should NC SMBs Prepare for July 14, 2026?
The preparation is a two-week audit followed by a two-week remediation. Any NC SMB starting now has a clean margin. Any SMB starting after July 14 is doing incident response.
Stage 1 — Audit (next 5 business days).
- Enable the November 2025 KB5052916 audit events. Events
4768,4769, and4770with encryption type0x17(RC4-HMAC) or0x18(RC4-HMAC-EXP) identify RC4 ticket activity. Ship these to your SIEM and filter by client IP for a complete inventory. - Audit
msDS-SupportedEncryptionTypeson every account. Any user or computer account with the attribute unset defaults to including RC4 in the acceptable set. Any account with0x4(RC4) explicitly permitted must be reviewed. - Inventory service accounts, service principal names (SPNs), and trust objects. SPN-registered accounts, cross-forest trust objects, and any account with "Do not require Kerberos pre-authentication" are highest priority.
- Inventory legacy devices and legacy apps. Every printer, scanner, Linux host, and Java line-of-business app touches Kerberos. Interview owners on remediation plans.
Stage 2 — Remediate (next 15 business days).
- Set every eligible account to AES-only. Set
msDS-SupportedEncryptionTypesto0x18(AES-128-CTS-HMAC-SHA1-96 + AES-256-CTS-HMAC-SHA1-96). Reset the account password after the change so the KDC actually creates AES keys. - Upgrade or replace legacy MFPs. 2022-and-later firmware from all major vendors supports AES-256. Firmware upgrades are typically free.
- Upgrade or reconfigure legacy Java apps. JDK 11 and later default to AES. Custom
krb5.conffiles needdefault_tkt_enctypesanddefault_tgs_enctypesset to AES-only. - Retire Windows Server 2012 R2 domain controllers. If a DC is still on 2012 R2, the July 14 enforcement is the least of your problems. Move to Windows Server 2022 or 2025.
- Enable "Do not require Kerberos preauthentication" cleanup. This flag should be off on every account. Audit and clear.
- Test cross-forest trusts. Set trust objects to AES-only and validate authentication both directions before enforcement day.
Stage 3 — Monitor (July 14 onward).
- SIEM alerting on Kerberos failures. Any surge in event
4771(Kerberos pre-authentication failed) or4625(logon failure) on July 14 indicates a missed remediation. - Detect kerberoasting. Event
4769for accounts with encryption type0x17after enforcement day should be zero. Any occurrence is either a missed remediation or an active attack. - MSSP escalation. For NC SMBs with 24/7 SOC coverage, kerberoasting detection is a documented use case. Confirm your MSSP has the rule tuned.
| Control | Addresses | Effort |
|---|---|---|
| Enable KB5052916 audit events | Blind spots on RC4 usage | 1 day |
Audit msDS-SupportedEncryptionTypes | Silent RC4 fallback | 2-3 days |
| MFP/scanner firmware upgrade | Print/scan authentication break | 3-5 days |
Legacy Java krb5.conf update | Line-of-business app auth break | 3-5 days |
| Service account AES-only migration | Kerberoasting exposure | 1 week |
| Cross-forest trust AES-only | Partner authentication break | 1 week |
| SIEM kerberoasting rule | Post-enforcement detection | 2-3 days |
Explore Preferred Data's cybersecurity services
What Are the Warning Signs You Missed a Remediation?
Missed remediations produce a consistent fingerprint on July 14 and after. Every NC SMB with domain controllers should have alerts on these events.
High-confidence signals of a missed remediation:
- Surge in Kerberos pre-authentication failures. Windows event
4771with error code0x18on domain controllers. - Print, scan, or line-of-business app auth outages. User tickets clustering around a specific app or MFP after July 14 Patch Tuesday.
- Cross-forest trust failures. Partner or acquired-company authentication breaks after enforcement day.
- Service account logon failures. Scheduled tasks, IIS app pools, and Windows services running under a domain account fail to authenticate.
Signals of an active kerberoasting attempt:
- TGS requests with RC4 encryption type after enforcement. Event
4769with encryption type0x17should be zero after July 14. Any occurrence is either misconfiguration or an active adversary probing for RC4 fallback. - Bulk TGS requests from a single account. A user account requesting service tickets for dozens or hundreds of SPNs in a short window is the kerberoasting workflow. It should trigger an MSSP SOC page.
If you see any of these, treat as active incident. Isolate the affected system, rotate the affected account's password, escalate to a 24/7 incident response provider. Preferred Data delivers same-day incident response for NC SMBs within 200 miles of High Point.
If you find kerberoasting artifacts post-July 14, call Preferred Data at (336) 886-3282 for expedited incident response.
How Does This Connect to Broader 2026 Identity Security?
The July 14, 2026 Kerberos enforcement is one of three 2026 Microsoft identity hardening milestones every NC SMB should be tracking. Together they reshape Active Directory posture requirements for the balance of the decade.
Three 2026 Microsoft identity milestones:
- KB5052916 Kerberos RC4 enforcement — July 14, 2026. Discussed here.
- NTLM audit-to-enforce transition — Q4 2026. NTLM authentication requests transition from audit to warn-then-block for domain-joined systems. NC SMBs with legacy SMB1/2 file shares or legacy authentication apps face the same audit-remediate playbook.
- Windows 10 ESU Year 2 endpoint — October 2026. ESU-enrolled Windows 10 endpoints continue to receive Kerberos updates, but ESU cost per device makes the migration economics obvious.
For NC manufacturers, construction firms, healthcare providers, professional-services offices, and financial institutions, the compound effect is that Active Directory identity posture is no longer optional. Cyber insurance underwriting, FTC Safeguards Rule, HIPAA, and CMMC 2.0 all treat AES-only Kerberos as table stakes.
Review Preferred Data's cybersecurity checklist
How Does Preferred Data Deliver the AD Cutover?
Preferred Data Corporation delivers Active Directory hardening audits, msDS-SupportedEncryptionTypes migration, legacy device and application inventory, MFP firmware upgrade coordination, service account password rotation with AES key regeneration, cross-forest trust AES-only migration, and 24/7 kerberoasting detection for NC manufacturers, construction firms, healthcare providers, professional-services offices, and financial institutions.
With 37+ years of North Carolina IT expertise, an average client retention of 20+ years, and deep experience with the exact legacy ERP-and-MFP stacks NC manufacturers run, our AD hardening program integrates with your existing MSP, MSSP, and cyber insurance controls.
Our Kerberos hardening package includes a full RC4 audit against KB5052916 telemetry, an msDS-SupportedEncryptionTypes posture report by account type, a printer/scanner firmware roadmap, a legacy Java and ERP client migration plan, service account rotation with AES key regeneration, and post-enforcement SIEM tuning for kerberoasting detection.
For businesses within 200 miles of High Point, we deliver on-site support for the legacy MFPs, plant-floor Java clients, and Actian Zen ERP integrations that make remote-only remediation impossible.
Contact Preferred Data Corporation — same-week Active Directory audit engagement.
Frequently Asked Questions
What is Kerberos RC4 hardening and when does enforcement land?
Kerberos RC4 hardening is Microsoft's multi-phase deprecation of RC4-HMAC Kerberos ticket encryption, delivered via KB5052916 starting November 2025. The audit-to-enforce transition ships in the July 14, 2026 Patch Tuesday cumulative updates. On that date, domain controllers refuse to issue or accept RC4-HMAC tickets by default.
What breaks on July 14, 2026 if we do nothing?
Any device or application that still requests RC4-HMAC Kerberos tickets fails to authenticate. Common casualties: legacy MFPs (scan-to-folder, LDAP address book), legacy Java line-of-business apps, older Linux/Unix hosts with MIT Kerberos before 1.19, cross-forest trust authentication, and older service accounts.
What are kerberoasting and AS-REP roasting?
Two credential-theft techniques that extract Kerberos tickets from Active Directory and crack them offline. Both depend on RC4 encryption for reasonable crack speeds. AES-encrypted tickets are computationally infeasible to crack in reasonable time. RC4 enforcement effectively kills both techniques.
We do not have developers. Why does this matter?
Active Directory authentication is not a developer concern. It is a domain controller and endpoint concern. If your NC SMB has domain-joined Windows machines, this affects you. If you have printers, scanners, or line-of-business apps, this likely breaks something.
How do we audit msDS-SupportedEncryptionTypes?
PowerShell: Get-ADUser -Filter * -Properties msDS-SupportedEncryptionTypes | Select-Object Name, msDS-SupportedEncryptionTypes. The same query applies to Get-ADComputer. Any unset or null value defaults to including RC4. Any explicit 0x4 value permits RC4.
Should we upgrade legacy MFPs or work around them?
Upgrade or replace. Firmware from 2022 and later on Ricoh, Canon, Xerox, HP, and Konica Minolta supports AES-256 Kerberos. Firmware upgrades are typically free. Working around by permitting RC4 on the MFP account leaves the kerberoasting exposure open.
What about our Actian Zen / Pervasive SQL integration?
Actian Zen server itself does not use Kerberos, but the Windows service accounts running it do. The AES migration applies to the service account, not the database. Preferred Data has 20+ years of Actian Zen experience and knows the exact migration path.
Can Preferred Data run the AD cutover before July 14?
Yes. Our Active Directory hardening audit is a 5-10 day engagement for a typical NC SMB and delivers a full RC4 inventory, remediation plan, and MSSP SIEM tuning for kerberoasting detection. Call (336) 886-3282 to start the engagement before Patch Tuesday.