KerberosSupportedEncryptionType: New resource proposal - Githubissues

dsccommunity / SChannelDsc

MIT License

12 stars 6 forks source link

KerberosSupportedEncryptionType: New resource proposal #1

Closed fullenw1 closed 4 years ago

fullenw1 commented 4 years ago

Description

Thanks for having created this very useful module. I am already testing it...

Here is another possible related resource: It's a GPO named: Network Security: Configure encryption types allowed for Kerberos

Documentation:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos

https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2016-12-19/finding/V-21954

Proposed properties

SupportedEncryptionTypes:

DES_CBC_CRC: Enabled|Disabled
DES_CBC_MD5: Enabled|Disabled
RC4_HMAC_MD5: Enabled|Disabled
AES128_HMAC_SHA1: Enabled|Disabled
AES256_HMAC_SHA1: Enabled|Disabled
Future encryption types: Enabled|Disabled

Special considerations or limitations

ykuijs commented 4 years ago

Am working on implementing this functionality. Will be included in next version.