Policy
Configure hash algorithms for certificate logon
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows11
This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication. If you enable this policy, you will be able to configure one of four states for each algorithm: - “Default” sets the algorithm to the recommended state. - “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security. - “Audited” enables usage of the algorithm and reports an event (ID 309) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled. - “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. If you disable or do not configure this policy, each algorithm will assume the “Default” state. More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037. Events generated by this configuration: 309, 310.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name PKINITHashAlgorithmConfigurationEnabled | REG_DWORD | HKLM 1 | HKLM 0 |
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | SHA-1 ID PKINITHashAlgorithmSHA1 | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name PKINITSHA1 Type REG_DWORD | Options: Default (1), Supported (3), Audited (2), Not Supported (0) | |
| Computer | SHA-256 ID PKINITHashAlgorithmSHA256 | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name PKINITSHA256 Type REG_DWORD | Options: Default (1), Supported (3), Audited (2), Not Supported (0) | |
| Computer | SHA-384 ID PKINITHashAlgorithmSHA384 | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name PKINITSHA384 Type REG_DWORD | Options: Default (1), Supported (3), Audited (2), Not Supported (0) | |
| Computer | SHA-512 ID PKINITHashAlgorithmSHA512 | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name PKINITSHA512 Type REG_DWORD | Options: Default (1), Supported (3), Audited (2), Not Supported (0) |