Policy
Configure hash algorithms for certificate logon
This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication. If you enable this policy, you will be able to configure one of four states for each algorithm: - “Default” sets the algorithm to the recommended state. - “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security. - “Audited” enables usage of the algorithm and reports an event (ID 309) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled. - “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. If you disable or do not configure this policy, each algorithm will assume the “Default” state. More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037. Events generated by this configuration: 309, 310.
4c694fcffea6 PKINITHashAlgorithmConfiguration Registry
Copy registry mappings
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled (enabled) = 1
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITHashAlgorithmConfigurationEnabled (disabled) = 0HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA1HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA256HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA384HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters\PKINITSHA512Policy notes
This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication. If you enable this policy, you will be able to configure one of four states for each algorithm: - “Default” sets the algorithm to the recommended state. - “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security. - “Audited” enables usage of the algorithm and reports an event (ID 309) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled. - “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. If you disable or do not configure this policy, each algorithm will assume the “Default” state. More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037. Events generated by this configuration: 309, 310.