{"id":16826,"date":"2026-06-13T02:01:19","date_gmt":"2026-06-12T17:01:19","guid":{"rendered":"https:\/\/m365jp.net\/?p=16826"},"modified":"2026-06-13T02:03:02","modified_gmt":"2026-06-12T17:03:02","slug":"mc1388721-30-day-reminder-final-deployment-phase-for-kerberos-rc4-hardening-begins-with-the-july-2026-windows-security-update","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-06-13-mc1388721-30-day-reminder-final-deployment-phase-for-kerberos-rc4-hardening-begins-with-the-july-2026-windows-security-update","title":{"rendered":"MC1388721 | 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<hr>\n<table id=\"section\">\n<tbody>\n<tr>\n<th width=\"95%\">MC1388721 | 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<table id=\"data\">\n<tbody>\n<tr>\n<th>Classification<\/th>\n<td>stayInformed<\/td>\n<\/tr>\n<tr>\n<th>Last Updated<\/th>\n<td>06\/12\/2026 16:56:13<\/td>\n<\/tr>\n<tr>\n<th>Start Time<\/th>\n<td>06\/12\/2026 16:56:07<\/td>\n<\/tr>\n<tr>\n<th>End Time<\/th>\n<td>06\/12\/2027 16:56:07<\/td>\n<\/tr>\n<tr>\n<th>Message Content<\/th>\n<td>\n<div><b>What and Why<\/b><\/div>\n<div>Windows updates released in July 2026 will complete the <a href=\"https:\/\/support.microsoft.com\/topic\/1ebcda33-720a-4da8-93c1-b0496e1910dc#ID0EDBBP\" rel=\"noopener noreferrer\" target=\"_blank\">  final deployment phase<\/a> of protections for a Kerberos information disclosure vulnerability (<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-20833\" rel=\"noopener noreferrer\" target=\"_blank\">CVE\u20112026\u201120833<\/a>). Beginning with this   phase, Audit mode is removed, leaving Enforcement mode as the only available option for Kerberos RC4 usage on Windows domain controllers. Environments with remaining RC4 dependencies might experience authentication issues unless those dependencies are remediated   or explicitly configured before the July 2026 Windows security update is installed.<\/div>\n<div>  <\/div>\n<div><b>Rollout Schedule<\/b><\/div>\n<ul>\n<li>April 2026 &#8211; Enforcement Phase with manual rollback: With installation of the April 2026 Windows security update, default Kerberos behavior changes so domain controllers use AES\u2011SHA1-only encryption for accounts without  <a href=\"https:\/\/learn.microsoft.com\/troubleshoot\/windows-server\/windows-security\/kerberos-protocol-registry-kdc-configuration-keys\" rel=\"noopener noreferrer\" target=\"_blank\">  explicit encryption type<\/a> settings, and Enforcement mode is enabled by default on Windows domain controllers. Audit mode remains available as a manual rollback option until July 2026.<\/li>\n<li>July 2026 \u2013 Enforcement Phase: With installation of the July 2026 Windows security update, Audit mode is removed, and Enforcement mode becomes the only available behavior for supported Windows domain controllers.<\/li>\n<\/ul>\n<div>  <\/div>\n<div><b>Impact on Your Organization<\/b><\/div>\n<div>With installation of the July 2026 Windows security update, Windows domain controllers will no longer support Audit mode rollback behavior for Kerberos RC4 hardening. Environments with service accounts, applications, appliances, or devices that still rely   on RC4-based Kerberos tickets may experience authentication failures unless those dependencies have been remediated or explicitly configured to support continued RC4 usage where required.<\/div>\n<div>  <\/div>\n<div>Devices using non-Windows Kerberos implementations might also require additional interoperability testing to ensure continued authentication functionality after the July 2026 Enforcement phase begins.<\/div>\n<div>  <\/div>\n<div>Azure Files note: For devices using Azure Files SMB with Active Directory-based authentication, address any RC4 dependencies before installation of the July 2026 Windows security update to reduce the risk of access disruption once Audit mode is removed.   Follow the steps in the <a href=\"https:\/\/aka.ms\/rc4azurefiles\" rel=\"noopener noreferrer\" target=\"_blank\">  official documentation<\/a> to help maintain uninterrupted access to Azure Files and dependent workloads such as Azure Virtual Desktop.<\/div>\n<div>  <\/div>\n<div><b>Action Required\/Recommendations<\/b><\/div>\n<div>Continue monitoring the System event log for Kerberos-related events indicating RC4 dependencies or insecure encryption configurations. If event log data shows RC4 reliance, remediate by moving to AES\u2011based encryption or explicitly configuring the account\u2019s  <b>msds-SupportedEncryptionTypes<\/b> attribute where RC4 is still required.<\/div>\n<div>  <\/div>\n<div>Before deploying the July 2026 Windows security update, validate that service accounts, applications, and non-Windows Kerberos implementations can successfully authenticate without requiring RC4-based Kerberos authentication.<\/div>\n<div>  <\/div>\n<div><b>Compliance Considerations<\/b><\/div>\n<div>Audit events related to this change are only generated when Active Directory is unable to issue AES\u2011SHA1 service tickets or session keys. The absence of audit events does not guarantee that all non-Windows devices will successfully accept Kerberos authentication   after the July 2026 Enforcement phase begins. Validate interoperability through testing before broadly deploying the July 2026 Windows security update.<\/div>\n<\/td>\n<\/tr>\n<tr>\n<th>Machine Translation<\/th>\n<td>\n<div><b>\u4f55\u3068\u306a\u305c<\/b><\/div>\n<div>2026\u5e747\u6708\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305fWindows\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306f\u3001Kerberos\u60c5\u5831\u958b\u793a\u8106\u5f31\u6027(<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-20833\" rel=\"noopener noreferrer\" target=\"_blank\">CVE-2026-20833<\/a>)\u306b\u5bfe\u3059\u308b<a href=\"https:\/\/support.microsoft.com\/topic\/1ebcda33-720a-4da8-93c1-b0496e1910dc#ID0EDBBP\" rel=\"noopener noreferrer\" target=\"_blank\">\u4fdd\u8b77\u306e\u6700\u7d42\u5c55\u958b\u30d5\u30a7\u30fc\u30ba<\/a>\u3092\u5b8c\u4e86\u3055\u305b\u307e\u3059\u3002\u3053\u306e\u30d5\u30a7\u30fc\u30ba\u304b\u3089\u76e3\u67fb\u30e2\u30fc\u30c9\u306f\u524a\u9664\u3055\u308c\u3001Windows\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u3067\u306eKerberos   RC4\u4f7f\u7528\u306b\u304a\u3044\u3066Enforcement\u30e2\u30fc\u30c9\u306e\u307f\u304c\u5229\u7528\u53ef\u80fd\u306a\u9078\u629e\u80a2\u3068\u306a\u308a\u307e\u3059\u3002RC4\u4f9d\u5b58\u95a2\u4fc2\u304c\u6b8b\u3063\u3066\u3044\u308b\u74b0\u5883\u3067\u306f\u30012026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u308b\u524d\u306b\u305d\u308c\u3089\u306e\u4f9d\u5b58\u95a2\u4fc2\u304c\u4fee\u5fa9\u307e\u305f\u306f\u660e\u793a\u7684\u306b\u8a2d\u5b9a\u3055\u308c\u306a\u3044\u9650\u308a\u3001\u8a8d\u8a3c\u554f\u984c\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/div>\n<div>  <\/div>\n<div><b>\u5c55\u958b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb<\/b><\/div>\n<ul>\n<li>2026\u5e744\u6708 &#8211; \u624b\u52d5\u30ed\u30fc\u30eb\u30d0\u30c3\u30af\u3092\u4f34\u3046\u5f37\u5236\u30d5\u30a7\u30fc\u30ba:2026\u5e744\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u3088\u308a\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u306eKerberos\u52d5\u4f5c\u304c\u5909\u66f4\u3055\u308c\u3001\u660e  <a href=\"https:\/\/learn.microsoft.com\/troubleshoot\/windows-server\/windows-security\/kerberos-protocol-registry-kdc-configuration-keys\" rel=\"noopener noreferrer\" target=\"_blank\">  \u793a\u7684\u306a\u6697\u53f7\u5316\u30bf\u30a4\u30d7<\/a> \u8a2d\u5b9a\u304c\u306a\u3044\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u306f\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u304cAES-SHA1\u306e\u307f\u306e\u6697\u53f7\u5316\u3092\u4f7f\u7528\u3057\u3001Windows\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u3067\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u5f37\u5236\u30e2\u30fc\u30c9\u304c\u6709\u52b9\u5316\u3055\u308c\u307e\u3059\u3002\u76e3\u67fb\u30e2\u30fc\u30c9\u306f2026\u5e747\u6708\u307e\u3067\u624b\u52d5\u30ed\u30fc\u30eb\u30d0\u30c3\u30af\u30aa\u30d7\u30b7\u30e7\u30f3\u3068\u3057\u3066\u5229\u7528\u53ef\u80fd\u3067\u3059\u3002<\/li>\n<li>2026\u5e747\u6708 &#8211; \u5f37\u5236\u30d5\u30a7\u30fc\u30ba:2026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u3088\u308a\u3001\u76e3\u67fb\u30e2\u30fc\u30c9\u304c\u524a\u9664\u3055\u308c\u3001\u9069\u7528\u30e2\u30fc\u30c9\u304c\u5bfe\u5fdcWindows\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u3067\u552f\u4e00\u306e\u52d5\u4f5c\u3068\u306a\u308a\u307e\u3059\u3002<\/li>\n<\/ul>\n<div>  <\/div>\n<div><b>\u7d44\u7e54\u3078\u306e\u5f71\u97ff<\/b><\/div>\n<div>2026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u3088\u308a\u3001Windows\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306fKerberos RC4\u306e\u30cf\u30fc\u30c9\u30cb\u30f3\u30b0\u306b\u5bfe\u3059\u308b\u76e3\u67fb\u30e2\u30fc\u30c9\u30ed\u30fc\u30eb\u30d0\u30c3\u30af\u52d5\u4f5c\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u306a\u304f\u306a\u308a\u307e\u3059\u3002\u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3001\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u3001\u307e\u305f\u306fRC4\u30d9\u30fc\u30b9\u306eKerberos\u30c1\u30b1\u30c3\u30c8\u306b\u4f9d\u5b58\u3057\u3066\u3044\u308b\u74b0\u5883\u3067\u306f\u3001\u4f9d\u5b58\u95a2\u4fc2\u304c\u4fee\u5fa9\u3055\u308c\u3066\u3044\u308b\u304b\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066RC4\u306e\u7d99\u7d9a\u4f7f\u7528\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u3088\u3046\u306b\u660e\u793a\u7684\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u9650\u308a\u3001\u8a8d\u8a3c\u5931\u6557\u304c\u767a\u751f\u3059\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002<\/div>\n<div>  <\/div>\n<div>Windows\u4ee5\u5916\u306eKerberos\u5b9f\u88c5\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30c7\u30d0\u30a4\u30b9\u306f\u30012026\u5e747\u6708\u306e\u5f37\u5236\u30d5\u30a7\u30fc\u30ba\u958b\u59cb\u5f8c\u3082\u8a8d\u8a3c\u6a5f\u80fd\u306e\u7d99\u7d9a\u3092\u4fdd\u8a3c\u3059\u308b\u305f\u3081\u306b\u8ffd\u52a0\u306e\u76f8\u4e92\u904b\u7528\u6027\u30c6\u30b9\u30c8\u304c\u5fc5\u8981\u306b\u306a\u308b\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002<\/div>\n<div>  <\/div>\n<div>Azure Files \u6ce8\u610f:Active Directory\u30d9\u30fc\u30b9\u306e\u8a8d\u8a3c\u3067Azure Files SMB\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30c7\u30d0\u30a4\u30b9\u306b\u3064\u3044\u3066\u306f\u30012026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u524d\u306bRC4\u4f9d\u5b58\u95a2\u4fc2\u3092\u89e3\u6c7a\u3057\u3001\u76e3\u67fb\u30e2\u30fc\u30c9\u89e3\u9664\u5f8c\u306e\u30a2\u30af\u30bb\u30b9\u969c\u5bb3\u306e\u30ea\u30b9\u30af\u3092\u6e1b\u3089\u3057\u3066\u304f\u3060\u3055\u3044\u3002Azure Files\u3084Azure Virtual Desktop\u306a\u3069\u306e\u4f9d\u5b58\u30ef\u30fc\u30af\u30ed\u30fc\u30c9\u3078\u306e\u7d99\u7d9a\u7684\u306a\u30a2\u30af\u30bb\u30b9\u3092\u7dad\u6301\u3059\u308b\u305f\u3081\u306b  <a href=\"https:\/\/aka.ms\/rc4azurefiles\" rel=\"noopener noreferrer\" target=\"_blank\">  \u3001\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a> \u306e\u624b\u9806\u306b\u5f93\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n<div>  <\/div>\n<div><b>\u5fc5\u8981\u306a\u884c\u52d5\/\u63d0\u8a00<\/b><\/div>\n<div>RC4\u4f9d\u5b58\u95a2\u4fc2\u3084\u4e0d\u5b89\u5168\u306a\u6697\u53f7\u5316\u8a2d\u5b9a\u3092\u793a\u3059Kerberos\u95a2\u9023\u30a4\u30d9\u30f3\u30c8\u306e\u76e3\u8996\u3092\u7d9a\u3051\u3066\u304f\u3060\u3055\u3044\u3002\u30a4\u30d9\u30f3\u30c8\u30ed\u30b0\u30c7\u30fc\u30bf\u3067RC4\u4f9d\u5b58\u304c\u793a\u3055\u308c\u305f\u5834\u5408\u306f\u3001AES\u30d9\u30fc\u30b9\u306e\u6697\u53f7\u5316\u306b\u5207\u308a\u66ff\u3048\u308b\u304b\u3001RC4\u304c\u307e\u3060\u5fc5\u8981\u306a\u5834\u5408\u306f\u30a2\u30ab\u30a6\u30f3\u30c8\u306e  <b>msds-SupportedEncryptionTypes<\/b> \u5c5e\u6027\u3092\u660e\u793a\u7684\u306b\u8a2d\u5b9a\u3057\u3066\u88dc\u6b63\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n<div>  <\/div>\n<div>2026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5c55\u958b\u3059\u308b\u524d\u306b\u3001\u30b5\u30fc\u30d3\u30b9\u30a2\u30ab\u30a6\u30f3\u30c8\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3001\u975eWindows\u306eKerberos\u5b9f\u88c5\u304cRC4\u30d9\u30fc\u30b9\u306eKerberos\u8a8d\u8a3c\u306a\u3057\u3067\u6b63\u5e38\u306b\u8a8d\u8a3c\u3067\u304d\u308b\u304b\u3092\u691c\u8a3c\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n<div>  <\/div>\n<div><b>\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306e\u8003\u616e\u4e8b\u9805<\/b><\/div>\n<div>\u3053\u306e\u5909\u66f4\u306b\u95a2\u9023\u3059\u308b\u76e3\u67fb\u30a4\u30d9\u30f3\u30c8\u306f\u3001Active Directory\u304cAES-SHA1\u30b5\u30fc\u30d3\u30b9\u30c1\u30b1\u30c3\u30c8\u3084\u30bb\u30c3\u30b7\u30e7\u30f3\u30ad\u30fc\u3092\u767a\u884c\u3067\u304d\u306a\u3044\u5834\u5408\u306e\u307f\u751f\u6210\u3055\u308c\u307e\u3059\u3002\u76e3\u67fb\u30a4\u30d9\u30f3\u30c8\u304c\u306a\u304b\u3063\u305f\u304b\u3089\u3068\u3044\u3063\u3066\u30012026\u5e747\u6708\u306e\u5f37\u5236\u30d5\u30a7\u30fc\u30ba\u958b\u59cb\u5f8c\u306b\u3059\u3079\u3066\u306e\u975eWindows\u30c7\u30d0\u30a4\u30b9\u304cKerberos\u8a8d\u8a3c\u3092\u6b63\u5e38\u306b\u53d7\u3051\u5165\u308c\u3089\u308c\u308b\u4fdd\u8a3c\u306f\u3042\u308a\u307e\u305b\u3093\u30022026\u5e747\u6708\u306eWindows\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5e83\u304f\u5c55\u958b\u3059\u308b\u524d\u306b\u3001\u30c6\u30b9\u30c8\u3092\u901a\u3058\u3066\u76f8\u4e92\u904b\u7528\u6027\u3092\u691c\u8a3c\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MC1388721 | 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windo [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16826","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/16826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=16826"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/16826\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=16826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=16826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=16826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}