[Question]: SupportsKerberosAESEncryption returns false as default

[HoffmannTom]

Question

Hello,
the method SupportsKerberosAESEncryption() returns false if the SupportedEncryptionTypes-field is empty.
As far as I know, this doesn't mean that AES is not supported. It just means, it supports all encryptions that are available domain-wide. This includes AES encryption for currently all supported windows server versions.

Checklist

• I have searched the existing issues and documentation for an answer to my question.

[MichaelGrafnetter]

@HoffmannTom Thanks for the suggestion. You are right, false is the old default. Since KB5021131, AES support also depends on DC update version and the DefaultDomainSupportedEncTypes setting. This information is not available in the AD database itself, so returning true by default could yield false negatives. I am thus not sure what the right approach here is.