RC4 and msDS-SupportedEncryptionTypes

So to mop up the things after we finally patched our DCs this month, I found a bunch of objects set with msDS-SupportedEncryptionTypes set. Exported to CSV for safekeeping and went to work gutting out what made sense.. which is most all objects at this point. Some had different values.. but most all were set to 28.

Interestingly, I found that most of the workstation objects were getting 28 set again.

I haven't set the default for the domain yet, and we left things set to enforced mode.

Not an issue itself.. and we are still fetching all the log queries for Get-KerbEncryptionUsage et al.. but wasn't expecting this attribute to get set. Aside.. the value for 28 is RC4/AES128/AES256.. seems counter to the enforcement phase value I'd expect.

So at this point I don't much care about this activity.. we have zero workstations needing RC4 as it is.. but the fact that the value is being set at all is rather annoying when I don't need it.