GPO tool

Group Policy made searchable

A free ADMX browser or comparison tool for IT administrators.Search policies, find registry keys, and see exactly what each setting writes to the Windows Registry. Or compare two GPO backups to see exactly what has changed between them.

Select a product
  • Select a category.

Configure hash algorithms for certificate logon

This policy setting controls hash or checksum algorithms used by the Kerberos client when performing certificate authentication.

If you enable this policy, you will be able to configure one of four states for each algorithm:

- “Default” sets the algorithm to the recommended state.

- “Supported” enables usage of the algorithm. Enabling algorithms that have been disabled by default may reduce your security.

- “Audited” enables usage of the algorithm and reports an event (ID 206) every time it is used. This state is intended to verify that the algorithm is not being used and can be safely disabled.

- “Not Supported” disables usage of the algorithm. This state is intended for algorithms that are deemed to be insecure.

If you disable or do not configure this policy, each algorithm will assume the “Default” state.
More information about the hash and checksum algorithms supported by the Windows Kerberos client and their default states can be found at https://go.microsoft.com/fwlink/?linkid=2169037.

Events generated by this configuration: 205, 206, 207, 208.

Registry Information

VendorMicrosoft
ProductKerberos Settings
CategoryKerberos
Applies toComputer Configuration
Supported onWindows 11 0 22H2 NOSERVER
Registry Key[HKLM]SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosParameters
Value NamePKInitHashAlgorithmConfigurationEnabled
TypeREG_DWORD
Enabled value1
Disabled value0

Policy Settings

SHA-1

Registry Key[HKLM]SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosParameters
Value NamePKInitSHA1
TypeREG_DWORD
Values
  • Default (1)
  • Supported (3)
  • Audited (2)
  • Not Supported (0)

SHA-256

Registry Key[HKLM]SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosParameters
Value NamePKInitSHA256
TypeREG_DWORD
Values
  • Default (1)
  • Supported (3)
  • Audited (2)
  • Not Supported (0)

SHA-384

Registry Key[HKLM]SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosParameters
Value NamePKInitSHA384
TypeREG_DWORD
Values
  • Default (1)
  • Supported (3)
  • Audited (2)
  • Not Supported (0)

SHA-512

Registry Key[HKLM]SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosParameters
Value NamePKInitSHA512
TypeREG_DWORD
Values
  • Default (1)
  • Supported (3)
  • Audited (2)
  • Not Supported (0)