# Ensure 'Network security: Configure encryption types allowed for Kerberos' is set to 'AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types'

Necessity: Kerberos is a core authentication protocol in Windows environments. This setting dictates which cryptographic algorithms are used to protect Kerberos tickets (TGTs and service tickets). Allowing weak or legacy encryption types, such as RC4, exposes Kerberos tickets to offline brute-force and password-guessing attacks, potentially leading to credential theft and privilege escalation. Enforcing strong encryption like AES ensures the confidentiality and integrity of authentication data, significantly reducing the risk of compromise.

Auditing and Remediation: The audit script inspects the registry value 'SupportedEncryptionTypes' to determine the currently enabled cipher suites. The value is a bitmask where specific bits correspond to different encryption algorithms. The remediation script modifies this registry value to align with a secure configuration, disabling outdated ciphers and enabling strong, modern alternatives.

Recommended State Rationale: The recommended value for all levels (Basic, Moderate, and Strict) is '2147483640'. This decimal value represents the bitmask that enables 'AES128_HMAC_SHA1', 'AES256_HMAC_SHA1', and 'Future encryption types' while explicitly disabling the vulnerable RC4-HMAC algorithm. This configuration is the industry-standard recommendation (e.g., CIS Benchmarks) for securing Kerberos. It provides a robust defense against modern attacks while maintaining compatibility with contemporary systems. Including 'Future encryption types' ensures forward compatibility with stronger algorithms as they are introduced. Given the critical nature of Kerberos, there is no less-secure 'Basic' or 'Moderate' state that is considered acceptable; all systems should adopt this secure baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2147483640']` |
| **Moderate** | `['2147483640']` |
| **Strict** | `['2147483640']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry for the 'SupportedEncryptionTypes' DWORD value located at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters'. The script should output only the decimal value of this setting. If the value does not exist, the script should return '0'.

## Remediation Script Working

PowerShell script that accepts one positional command-line argument, which is the desired decimal integer for the supported encryption types. The script must set the 'SupportedEncryptionTypes' DWORD value at 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters'. If the path does not exist, the script must create it. The script must output '$true' upon successful modification or if the setting is already correct, and '$false' otherwise.

