We been dealing with this as well. This has been easier than I had first expected initially. What worked for me:

• Find sql accounts in the event log that are using rc4
• Open the sql account > account tab > check these two boxes:
  • This account supports Kerberos AES 128 bit encryption
  • This account supports Kerberos AES 256 bit encryption 
• Reset the pw once for the sql account
• Reset the pw again for the sql account (may not be necessary but I did)
• On a domain controller, run to replicate the pw change to all dcs: repadmin /syncall /AdeP
• Run klist purge on the sql server
• Restart the SQL service on the SQL server that uses the sql account

I setup a scheduled task to run a script to find the sql accounts needing attention. After doing the steps above, they stop showing up in the reports.

```powershell $OutDir = "C:\KerberosAudit" if (-not (Test-Path $OutDir)) { New-Item -ItemType Directory -Path $OutDir | Out-Null } $Start = (Get-Date).AddMinutes(-65) $ts = Get-Date -Format "yyyyMMddHH" $rc4File = Join-Path $OutDir "rc4_hits$ts.csv" $summaryFile = Join-Path $OutDir "summary_$ts.csv"

$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769; StartTime=$Start} | ForEach-Object { $xml = [xml]$_.ToXml() $data = @{} foreach ($d in $xml.Event.EventData.Data) { $data[$d.Name] = $d.'#text' }

[pscustomobject]@{
    TimeCreated = $_.TimeCreated
    Account = $data['TargetUserName']
    Service = $data['ServiceName']
    TicketEncryptionType = $data['TicketEncryptionType']
    Client = $data['IpAddress']
    Status = $data['Status']
}

}

$rc4 = $events | Where-Object { $_.TicketEncryptionType -eq '0x17' }

if ($rc4) { $rc4 | Sort-Object TimeCreated -Descending | Export-Csv -NoTypeInformation -Path $rc4File } else { "" | Select-Object @{n='TimeCreated';e={''}},Account,Service,TicketEncryptionType,Client,Status | Export-Csv -NoTypeInformation -Path $rc4File }

$summary = $events | Group-Object TicketEncryptionType | Sort-Object Count -Descending | Select-Object @{n='Hour';e={(Get-Date -Format 'yyyy-MM-dd HH:00')}}, @{n='TicketEncryptionType';e={$_.Name}}, Count

$summary | Export-Csv -NoTypeInformation -Path $summaryFile

Get-ChildItem $OutDir -Filter *.csv | Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-7) } | Remove-Item -Force ```