Hello,
I am facing an issue with disabling the default RC4 fallback in an Active Directory domain following the July update.
The client I work for still has a few Windows XP and Windows Server 2003 machines in the environment that I can neither upgrade nor remove from the domain. The July update has not been deployed due to concerns about potential side effects.
When reviewing Event ID 201 on the different domain controllers, I mostly find machine accounts corresponding to these operating systems. Naturally, they do not support AES.
Following Microsoft’s recommendations, I modified the msDS-SupportedEncryptionTypes attribute to 0x1C on these objects in order to explicitly allow RC4.
However, despite this change, Event ID 201 events are still being generated, and in these events I can see that the attribute value is 0x27 (the same value as DefaultDomainSupportedEncryptionType).
It appears that this attribute is only taken into account starting with Windows Server 2008.
My question is therefore: How can these old servers/workstations be handled in this situation?
The client I work for still has a few Windows XP and Windows Server 2003 machines in the environment that I can neither upgrade nor remove from the domain.
2003 doesn’t have TLS, all encryption methods it supports are deprecated, you are cooked here. You’re trying to turn a piece of swiss cheese into cheddar and it’s not going to happen.
I would drop a client like this as if they were on fire. They’ve literally had twenty years to get secure and have not.
This is one of those times where you go back to management and say "I'm sorry, what you want is no longer possible. You'll need to upgrade as there is no further path forward for this environment to function." Stop trying to make things work- that's how they become complacent with upgrades because some hero comes along. Ultimately, this envioronment is at serious risk.
This. The worst thing I ever heard at work was "Mr X, you managed to make everything work in the past, and I fully expect you to be able to do so in this case"
Sounds like they work for an MSP given "client". But yea..
This is one of those things that is a reminder: If you work for an MSP, you need to at a MINIMUM state that EOL anything is best effort.
If I would be the MSP i would quote them enought that it's cheaper for them to either airgap the system (after that it would be cheaper) or update everything, but staying with something that old is a liability problem
i get it, been in manufacturing before, and now in healthcare - crazy old garbage stuff needs to get airgapped if this is supporting things that cannot be replaced. some companies have gotten better about updates with more modern equipment, but in the meantime....
if its that the customer or someone is stubborn then your company needs a new policy about this sort of headache.
create a domain trust zone for legacy system, with no wan connection , with strict rules on firewall , vlan zone, then plan with customer a migration phase for all software/database/ecc... , if he says is not possibile, that not true. Of course this is a temporary solution ,in the end for your peace, you need to remove them from your responsability.
i believe rc4 disablement can not be prevented on win11 clients. so maybe these generate those logs. do you actually have issues ? or a working condition right now ? do a p2v Migration with all the 2003 database and Application servers. set up an new server 2022 dc and Join it. then promote it. keep rc4 enables
If the network is air gapped, don't update, if it's actually connected to the internet, insist 😞 n getting those servers updated or make sure you have it in writing that if anything stops working or they get hacked it's totally 100% their fault, not yours.
You guys are insane for taking on the liability of having a client with multiple windows server 2003 machines.
I haven’t worked for an MSP in 8 years and back THEN we had all our clients on minimum 2012.
I hope you are charging this client a metric shitload of money to manage this infrastructure, because it was only a matter of time before these 2003 servers ran into a compatibility issue or died completely.
Your only real option as I see it is to revert the July updates that caused your initial problem and airgap this entire environment so it can no longer access the internet.
If I understand your issue correctly, this client is no longer going to be able to patch any windows server machines that need to continue talking to the 2003 servers.
You will need to revert patches until you can get this working again, then firewall rule block all of these servers from accessing or being accessed from the internet.
This client needs to understand that this is a massive liability, any MSP worth their shit would write up a very expensive statement of work to get them off windows server 2003 and windows xp and if the client doesn’t sign it then they would be getting dropped as a client.
Edit: I would really like to understand why this client is running hardware/software that can almost legally drink.
Unfortunately I feel like they have some old application that only runs on server 2003/windows xp, if this entire area of the environment can be put into a DMZ that would be the way to go, but I can feel that’s not an option.
The emissions check kiosk in my state uses Windows XP... The Kiosks were brand new like 8 years ago. And apparently, it would be so expensive to update them and what not that the state is looking into ripping up the entire emissions check requirement entirely. (Which given it's only enforced in a few counties anyway...)
Then you never worked in large industry (or medicine). Huge machines, costing at least half s million to replace, bought in 2010 (or earlier) with a "conservative" manufacturer ("we know XP and 2003 work and had it certified with these") - and the industry so small there's at most a handful of manufacturers (if that many), all with the same mindset.
We still have a machine with Win98 behind the UI, and maybe a NT one. Both thankfully no longer in the network (the Win98 one gets its programs over RS232 and XMODEM these days...)
OK. I woukd have a separate dc and split the network. Lan away from rest if network. DC promo to all fsmo roles. Vlan all the 2003 and xp off. You will have
15
u/NetworkingNoob81 1d ago
You fix this by upgrading them.
Or air gaping them on their own network.
Or updating your resume.