Windows Kerberos RC4 lockout arrives Tuesday — check your AD first

Microsoft’s July Patch Tuesday update on 14 July will permanently remove the ability to roll back Kerberos RC4 hardening on Windows domain controllers. If your business runs Active Directory and you haven’t audited for RC4 dependencies, you have three days to find out before things start breaking.

This is the final phase of a rollout that started in January 2026 with audit logging and moved to enforcement-with-rollback in April. As Microsoft confirmed in its 30-day reminder, the July update removes Audit mode entirely. After Tuesday, RC4 encryption in Kerberos authentication is off by default, with no safety net. If a service account or device still relies on RC4-based tickets, it will fail to authenticate — silently, in most cases.

Why this matters for Australian SMBs specifically: in our experience managing business networks across Sydney, the Central West, Brisbane, and Melbourne, the most common RC4 holdouts aren’t servers or workstations. They’re the things nobody thinks about — legacy multifunction printers with LDAP authentication, older NAS appliances with domain-joined SMB shares, POS terminals in hospitality venues running outdated firmware, and line-of-business accounting packages that haven’t been updated since the firm moved to the cloud. These are exactly the devices that’ll stop authenticating on Tuesday morning with no obvious error message.

What to do before Tuesday:

First, check your domain controller event logs for Kerberos events flagging RC4 usage — if you’ve had the April update installed, these should already be logging. Second, for any service account or device still using RC4, either migrate it to AES encryption or explicitly set the msDS-SupportedEncryptionTypes attribute on the account. Third, if you’re running Azure Files with AD-based authentication, follow Microsoft’s official guidance to avoid access disruptions. And don’t forget non-Windows devices — Linux boxes, network appliances, and older macOS clients using Kerberos may need separate testing.

If you’re not sure where to start or don’t have time to audit before Tuesday, talk to your IT provider now rather than after the phones start ringing on Wednesday.