Troubleshooting: IWASVC Changes After Windows Update KB5082142

Version Affected: All
 
 

Overview

This article explains how Windows Update KB5082142 changes the default Kerberos encryption type used by service accounts, and what to check afterward.

Cause

Microsoft released a cumulative Windows Update on April 14, 2026 (KB5082142) that changes the default Kerberos encryption method for the DefaultDomainSupportedEncTypes value in the Key Distribution Center (KDC). Service accounts that do not have an explicit msDS-SupportedEncryptionTypes attribute defined in Active Directory (AD) transition from RC4 to AES128/AES256 as the new default.

To determine which encryption method a service account is using, check the msDS-SupportedEncryptionTypes attribute in AD, or run the following PowerShell command, replacing <IWA SSO Service Account> with the appropriate service account name:

Get-ADUser -Identity <IWA SSO Service Account> -Properties msDS-SupportedEncryptionTypes | Format-List Name, msDS-SupportedEncryptionTypes

The returned value maps to an encryption type as follows:

• 0 = Default (RC4 typically)
• 4 = RC4-HMAC
• 8 = AES128
• 16 = AES256
• 24 = AES128 + AES256
• 28 = RC4 + AES128 + AES256

If the value is blank or shows <not set>, the account inherits the domain default — RC4 before this update, AES128/AES256 after it.

Resolution:

IWASVC is updated to automatically correct any service account that has a domain.com suffix appended in its configuration, to accommodate the AES128/AES256 salt calculation. If your environment does not use sAMAccountName, or has a case-sensitivity mismatch, you will need to manually re-enter the correct sAMAccountName service account in the datastore configuration settings. The account's User logon name (pre-Windows 2000) — the sAMAccountName — is case sensitive.

Depending on the msDS-SupportedEncryptionTypes value found above:

1. If the value was 0, blank, or <not set>: no updates are needed.
2. If the value was 8, 16, or 24: no updates are needed.
3. If the value was 4 or 28: the environment may continue to use RC4 after this update. SecureAuth recommends moving to AES128/AES256 (value 8, 16, or 24) as best practice.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.