Microsoft will finally kill obsolete cipher that has wreaked decades of havoc

Microsoft is finally phasing out RC4, the obsolete cipher that Windows has defaulted to in Active Directory for 26 years and which has long been linked to high-profile network compromises. The article notes that RC4 was central to securing the Windows component when Active Directory was rolled out in 2000, and that despite known vulnerabilities it remained a staple in SSL and TLS for years.

Microsoft says that by mid-2026 domain controller defaults for the Kerberos Key Distribution Center on Windows Server 2008 and later will only allow AES-SHA1, with RC4 disabled by default unless explicitly configured, and that administrators should identify systems still relying on RC4. The piece also points to an ongoing effort to help admins identify RC4 usage through updated KDC logs and new PowerShell scripts.

It cites previous incidents, including the Ascension breach, where RC4 played a key role, and recounts comments from Microsoft’s Steve Syfuhs about the challenges of killing off the algorithm. according to Dan Goodin.