All Episodes

May 15, 2025 4 mins

🎙️ In this episode of Directory Insights in 10 Minutes, powered by Guardians of the Directory, Craig Birch walks you through detecting and remediating a legacy misconfiguration that still haunts many AD environments: accounts limited to DES-only Kerberos encryption.

DES is weak, deprecated, and easily cracked — yet it's still lurking in environments where older configurations or forgotten accounts persist.

🔍 What You’ll Learn:• Why DES-only encryption is dangerous in modern AD environments
• How attackers exploit this weakness in Kerberos ticket exchanges
• PowerShell techniques to find accounts with DES enabled
• How to upgrade users to AES encryption using Set-ADUser
• GUI vs. script-based remediation — what’s faster and safer🛠️ PowerShell Spotlight:# Find users with DES-only encryption enabled

Get-ADUser -Filter {UserAccountControl -band 0x200000} -Properties UserAccountControl |

Select-Object Name, SamAccountName

# Remediate: Remove DES-only flag and enable AES

Set-ADUser username -KerberosEncryptionType AES128,AES256

✅ This helps ensure your accounts are no longer relying on crackable encryption standards.


✅ Quick Takeaways:

  • DES is deprecated and no longer secure

  • Many legacy accounts still silently rely on DES

  • Use PowerShell or GUI to detect and remediate fast

  • Always test before changing encryption settings on service accounts

  • Enforce stronger Kerberos encryption org-wide via GPO

💬 Found this helpful? Like, comment, or share. Got a topic for a future 10-minute breakdown? Drop it below — we’re listening.

📌 Powered by Guardians of the Directory


Mark as Played

Advertise With Us

Popular Podcasts

Las Culturistas with Matt Rogers and Bowen Yang

Las Culturistas with Matt Rogers and Bowen Yang

Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

24/7 News: The Latest

24/7 News: The Latest

The latest news in 4 minutes updated every hour, every day.

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.