Policy

Configure hash algorithms for certificate logon

Windows 11 25H2

Back to categoryOpen picker

Policy overview

Key metadata and intent for this policy.

ClassComputer
CategorySystem > Kerberos
Supported onAt least Windows 11 Version 22H2

Supported OS tags: Windows11

This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication. If you enable this policy, you will be able to configure one of four states for each algorithm: - “Default” sets the algorithm to the recommended state. - “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security. - “Audited” enables usage of the algorithm and reports an event (ID 206) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled. - “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure. If you disable or do not configure this policy, each algorithm will assume the “Default” state. More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037. Events generated by this configuration: 205, 206, 207, 208.

Internal name
PKInitHashAlgorithmConfiguration
Policy ID
acfa5b6688ab
Elements
4

Registry values

How enabled and disabled states update the registry.

Registry locationTypeEnabled valueDisabled value
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitHashAlgorithmConfigurationEnabledREG_DWORD
1
0

Policy elements

Inputs and configuration options exposed by this policy.

ElementTypeRegistry mappingConstraints & behavior
SHA-1
ID PKInitHashAlgorithmSHA1
enum
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA1
Type REG_DWORD
Options: Default (1), Supported (3), Audited (2), Not Supported (0)
SHA-256
ID PKInitHashAlgorithmSHA256
enum
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA256
Type REG_DWORD
Options: Default (1), Supported (3), Audited (2), Not Supported (0)
SHA-384
ID PKInitHashAlgorithmSHA384
enum
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA384
Type REG_DWORD
Options: Default (1), Supported (3), Audited (2), Not Supported (0)
SHA-512
ID PKInitHashAlgorithmSHA512
enum
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\PKInitSHA512
Type REG_DWORD
Options: Default (1), Supported (3), Audited (2), Not Supported (0)

Other policies in this category

Explore related policies at the same level.

View all policies in this category