Microsoft is taking significant steps to retire the outdated and risky RC4 encryption cipher, which has been part of Windows by default for the last 26 years. This decision comes after many years of serious cybersecurity issues linked to the cipher and increasing scrutiny from U.S. lawmakers.
RC4, developed by Ron Rivest in 1987, was integrated into Microsoft’s Active Directory when it launched in 2000. Despite being known for its vulnerabilities since its leak in the mid-’90s, it remained prevalent in various encryption protocols including SSL and TLS until the last decade. Microsoft’s reliance on RC4 allowed hackers to easily breach enterprise networks, including a notable incident where the cipher’s weakness contributed to a massive data breach at the healthcare organization Ascension, affecting millions of patients.
Due to pressure, particularly from Senator Ron Wyden, Microsoft announced plans to eliminate RC4 as an option for Kerberos authentication in Windows Server by mid-2026. Once implemented, only the more secure AES-SHA1 encryption will be permitted by default, effectively ending the era of RC4 usage unless explicitly allowed by system administrators.
As part of the transition, Microsoft is equipping administrators with tools to help identify legacy systems still using RC4. This includes updates to Kerberos Domain Controller logs to monitor RC4 requests and responses, as well as new PowerShell scripts to pinpoint RC4-dependent systems within networks.
The move to phase out RC4 comes alongside the acknowledgment that this transition has been complicated. Microsoft had hesitated in the past due to the extensive use of RC4 across versions of Windows over the last quarter-century. Even though RC4’s use has drastically declined in recent years, administrators are urged to audit their systems to ensure that the cipher’s vulnerabilities are not being exploited.
Through these actions, Microsoft aims to strengthen security standards and better protect enterprise networks against potential cyber threats tied to antiquated encryption methods.
