Windows Kerberos RC4 lockout arrives Tuesday — check your AD first

Microsoft’s July Patch Tuesday update on 14 July will permanently remove the ability to roll back Kerberos RC4 hardening on Windows domain controllers. If your business runs Active Directory and you haven’t audited for RC4 dependencies, you have three days to find out before things start breaking.

This is the final phase of a rollout that started in January 2026 with audit logging and moved to enforcement-with-rollback in April. As Microsoft confirmed in its 30-day reminder, the July update removes Audit mode entirely. After Tuesday, RC4 encryption in Kerberos authentication is off by default, with no safety net. If a service account or device still relies on RC4-based tickets, it will fail to authenticate — silently, in most cases.

Why this matters for Australian SMBs specifically: in our experience managing business networks across Sydney, the Central West, Brisbane, and Melbourne, the most common RC4 holdouts aren’t servers or workstations. They’re the things nobody thinks about — legacy multifunction printers with LDAP authentication, older NAS appliances with domain-joined SMB shares, POS terminals in hospitality venues running outdated firmware, and line-of-business accounting packages that haven’t been updated since the firm moved to the cloud. These are exactly the devices that’ll stop authenticating on Tuesday morning with no obvious error message.

What to do before Tuesday:

First, check your domain controller event logs for Kerberos events flagging RC4 usage — if you’ve had the April update installed, these should already be logging. Second, for any service account or device still using RC4, either migrate it to AES encryption or explicitly set the msDS-SupportedEncryptionTypes attribute on the account. Third, if you’re running Azure Files with AD-based authentication, follow Microsoft’s official guidance to avoid access disruptions. And don’t forget non-Windows devices — Linux boxes, network appliances, and older macOS clients using Kerberos may need separate testing.

If you’re not sure where to start or don’t have time to audit before Tuesday, talk to your IT provider now rather than after the phones start ringing on Wednesday.

How to find RC4 dependencies before they break

The quickest way to identify RC4-reliant services is to review your domain controller event logs. Since January, audit mode has been logging Event ID 4769 with encryption type 0x17 (RC4-HMAC). Any service or device generating these events will fail authentication after Tuesday’s update.

The most common culprits in business environments are older multifunction printers and copiers that authenticate against Active Directory to send scanned documents by email, legacy line-of-business applications that haven’t been updated in several years, and service accounts with outdated Kerberos configuration flags.

If you find dependencies you can’t immediately remediate, Microsoft provides a per-service exemption path using the msDS-SupportedEncryptionTypes attribute on the relevant computer or service account object in Active Directory. Treat this as a temporary measure rather than a permanent fix — the goal is to get services updated to AES encryption.

All IT can run an RC4 dependency audit on your domain environment. Contact our team if you need a hand before Tuesday’s update lands.