Microsoft Will Finally Kill an Encryption Cipher That Enabled a Decade of Windows Hacks

Microsoft will update Windows Server defaults by mid-2026 to disable RC4 for Kerberos KDCs and allow only AES-SHA1 by default; RC4 fallback has been a longstanding vulnerability exploited via Kerberoasting and was implicated in the Ascension breach that exposed 5.6 million patient records and disrupted 140 hospitals, so administrators must inventory and mitigate legacy systems that still rely on RC4.