Senator blasts Microsoft for making default Windows vulnerable to “Kerberoasting”

A US Senator has urged the Federal Trade Commission to investigate Microsoft for “gross cybersecurity negligence,” citing the default use of the RC4 encryption cipher in Windows and its link to a 2024 ransomware breach at Ascension that affected 5.6 million patients. Wyden’s letter argues that dangerous software engineering decisions and the continued reliance on RC4 enable Kerberoasting, a password-cracking technique that targets Kerberos-protected accounts.

Microsoft has said RC4 is an old standard, accounts for less than 0.1% of traffic, and that it is on a path to gradually disable its use while warning customers as it progresses. In a blog post, cryptography expert Matt Green noted that continued support for Kerberos and RC4, along with misconfigurations, opens networks to kerberoasting.

The company stated that in Q1 2026 any new Active Directory deployments using Windows Server 2025 will have RC4 disabled by default, with further mitigations planned for existing deployments. According to Microsoft, disabling RC4 completely would break many customer systems, so the roadmap aims to reduce its use while maintaining safety and compatibility.