Data Domain: Active Directory Kerberos Encryption Enhancements

Summary: Data Domain systems support Active Directory Kerberos authentication and are transitioning away from legacy encryption methods. Starting with DDOS 8.8 and future supported releases, Kerberos communications with Active Directory will use only AES128 and AES256 encryption, removing support for weaker ciphers such as RC4 and DES while maintaining normal CIFS share functionality. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

  • Users observe Active Directory accounts configured with msDS-SupportedEncryptionTypes values that include RC4 encryption.
  • Security or compliance reviews identify RC4 as an enabled Kerberos encryption type.
  • CIFS share access by Active Directory users may generate Netlogon requests that use RC4 encryption in certain Data Domain releases.
  • Users seek clarification regarding Kerberos encryption methods used between Data Domain and Active Directory.

Cause

The Active Directory attribute msDS-SupportedEncryptionTypes determines which Kerberos encryption types are permitted for a user, computer, or service account.

A value of 28 (0x1C) typically enables:
AES256-CTS-HMAC-SHA1-96 (16)
AES128-CTS-HMAC-SHA1-96 (8)
RC4-HMAC-MD5 (4)

A value of 31 (0x1F) indicates support for all common Kerberos encryption types, including DES, RC4, AES128, and AES256.
In affected Data Domain releases, CIFS share access by Active Directory users may result in Netlogon requests using RC4 encryption.

Resolution

CIFS shares on Data Domain are not impacted by this behavior and are not considered vulnerable due to the use of RC4 in Netlogon requests.
DDOS 8.8 supports only AES128 and AES256 Kerberos encryption algorithms.
Support for weak or deprecated encryption methods, including DES and RC4, have been removed from Kerberos communications with Active Directory.
These changes strengthen cryptographic compliance and align with current security best practices.
Similar encryption hardening improvements are planned for supported release branches to ensure consistent Kerberos security across environments.


Planned Release Updates

The following releases are expected to include the strengthened Kerberos encryption policy:

DDOS 7.13.1.80
DDOS 8.3.1.40
DDOS 8.6.1.20

 

Additional Information

Future Data Domain releases, including DDOS 7.12 and LTS releases 7.7.5.20 and 7.10.1.10, will use AES encryption for Netlogon requests.
DDOS 8.8.0.0 removes RC4-HMAC cipher support from Kerberos configuration.
Supported Kerberos encryption types in DDOS 8.8 are:

AES256-CTS-HMAC-SHA1-96 (AES256)
AES128-CTS-HMAC-SHA1-96 (AES128)

Affected Products

Data Domain
Article Properties
Article Number: 000494851
Article Type: Solution
Last Modified: 04 آب 2026
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.