The July 14, 2026 Windows security updates moved Microsoft's Kerberos RC4 hardening into enforcement for the service-ticket path addressed by CVE-2026-20833. Audit-only behavior and the temporary rollback setting are no longer the operating model. That means a legacy service account or appliance can fail authentication even though domain controllers are patched correctly and the application itself has not changed.
Why it matters in production
RC4 dependencies rarely appear in a clean asset list. They hide in service accounts without explicit encryption types, older Java stacks, Linux integrations, storage appliances, scheduled tasks, and vendor software that was installed years ago. Testing only interactive Windows logons misses the identities most likely to fail. The migration therefore belongs to application owners as much as to the Active Directory team.
The evidence should come from domain-controller events and real service-ticket requests. Teams need to identify principals still requesting RC4, inspect msDS-SupportedEncryptionTypes, verify AES keys exist, and distinguish a stale account configuration from a client that genuinely cannot use AES. Resetting a service-account password can create the missing AES keys, but only after dependencies and credential-update procedures are understood.
A controlled response groups findings by business service, assigns an owner, tests each integration with AES, and defines a replacement or isolation plan for products that cannot move. Monitoring must continue after the change because infrequent jobs and disaster-recovery procedures may not request tickets during a short pilot. A successful weekday test is weak evidence for a workload that runs only at month end.
Practical takeaway
The practical lesson is that Kerberos encryption is an application property expressed through Active Directory. Patching domain controllers completes the security change, but application inventory completes the operational change. The teams that can connect ticket events to service ownership will resolve failures quickly; the teams that cannot will discover their RC4 estate one outage at a time.