Microsoft is finally ripping out one of the weakest links in its identity stack, cutting off a legacy cipher that attackers have abused for years to walk straight into corporate networks. The move ...

RC4 encryption has been cracked for over a decade. Now Microsoft is slowly sweeping the last remnants, such as in Kerberos, away.

By mid-2026, Windows domain controllers will default to allowing only AES-SHA1, with RC4 disabled unless administrators explicitly re-enable it. Microsoft says eliminating RC4 proved complicated due ...