# Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'

Necessity: Kerberos is the primary authentication protocol in Windows Active Directory environments. The encryption types it uses are critical for protecting authentication data, such as tickets, from being compromised. Older encryption types like RC4_HMAC are considered weak and are vulnerable to offline cracking attacks. If an attacker captures Kerberos traffic encrypted with weak ciphers, they can potentially recover user credentials, leading to attacks like Pass-the-Ticket or Golden Ticket, and ultimately a full domain compromise. Enforcing strong encryption types like AES128 and AES256 is essential to protect the integrity and confidentiality of the authentication process.

Auditing and Remediation: The audit script checks the 'SupportedEncryptionTypes' registry value, which is a bitmask that defines the enabled ciphers. The remediation script modifies this registry value to align with the recommended state, thereby disabling weak ciphers and enforcing strong ones for all Kerberos communications initiated by the machine.

Recommended State Rationale: The recommended decimal value '2147483640' corresponds to the hexadecimal value '0x7FFFFFF8'. This configuration enables AES128_HMAC_SHA1, AES256_HMAC_SHA1, and any future stronger encryption types that may be added to Windows, while explicitly disabling DES and RC4 ciphers. 
- Basic: This state is recommended as the minimum security baseline, as it removes all known weak ciphers and aligns with current industry best practices and security benchmarks (like CIS). 
- Moderate & Strict: For this particular setting, the 'Basic' configuration is already the most secure and forward-compatible option. There is no more secure state available, as it enables the strongest ciphers and prepares the system for future ones. Reducing the cipher selection (e.g., to only AES256) could introduce compatibility issues without a significant increase in practical security. Therefore, the Basic, Moderate, and Strict recommendations are identical, reflecting a single, robust security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2147483640']` |
| **Moderate** | `['2147483640']` |
| **Strict** | `['2147483640']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'SupportedEncryptionTypes' DWORD value from the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters'. The script must output only the raw decimal value. If the value or key does not exist, the script should output '0'.

## Remediation Script Working

PowerShell script that accepts a single positional argument, which is the desired decimal value as a string. The script must set the 'SupportedEncryptionTypes' DWORD value at the registry key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters' to the provided value. If the key path does not exist, it must be created. The script must return `$true` on success and `$false` on failure.

