Review the value to the following registry key to verify the DES_CBC_CRC and DES_CBC_MD5 encryption suites are not allowed.
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\
Value Name: SupportedEncryptionTypes
Type: REG_DWORD
The values are determined by the selection of encryption suites in the policy "Network Security: Configure encryption types allowed for Kerberos".
Due to the various possible combinations, it is not possible to include all acceptable values as viewed directly in the registry.
The value must be converted to binary to determine configuration of specific bits. This will determine whether this is a finding.
Note the value for the registry key.
For example when all suites, including the DES suites are selected, the value will be "0x7fffffff (2147483647)".
Open the Windows calculator (Run/Search for "calc").
Select "View", then "Programmer".
Select "Dword" and either "Hex" or "Dec".
Enter the appropriate form of the value found for the registry key (e.g., Hex - enter 0x7fffffff, Dec - enter 2147483647).
Select "Bin".
The returned value may vary in length, up to 32 characters.
If either of the 2 right most characters are "1", this is a finding.
If both of the 2 right most characters are "0", this is not a finding.