In the windows DC we found the event ID 5840 of VCenter account

[xorraadeu]

Hello everyone we get this event in the DC

The Netlogon service has created a secure channel with a client with RC4.  

 Account name: VC$ 
 Domain: hello.local 
 Account Type: Domain Member 
 Customer IP Address:  
 Negotiated Flags: 6007ffff  

For more information about why this was registered, visit https://go.microsoft.com/fwlink/?linkid=2209514.

If you encounter Event 5840, this is a sign that a client in your domain is using weak cryptography or RC4.

I have seen in the configuration file /etc/krb5.conf in the vcenter this comes up

default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC
default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC
preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC

I have looked at the kerberos ticket in the vcenter and I get Aes256 encryption and not RC4.

Ticket cache: FILE:/tmp/krb5cc_0
Default main: [e-mail] 

Valid starting Expires Service principal
01/27/2025 12:00 01/28/2025 12:00 krbtgt/hola.local @hola.local 
        Etype (encryption type): aes256-cts-hmac-sha1-96

I understand that I don't have to do anything since the vcenter account is already encrypting in AES256 and not RC4. 
Or do I have to do something else?

Thanks in advance

[Chris Smith]

Did you find a resolution to this? I am seeing the same articles and performed the same recommend solutions and still I have the RC4 events showing up on the DC's. 
Thanks 

-------------------------------------------

[Chris Smith]

I am seeing the same issue you are reporting here. I too have gone through everything I can find and made changes based on the articles listed by Broadcom with no change. Did you have any luck finding a solution? 

-------------------------------------------

[Nathan Watts]

Can you please advise the version and build number of your vCenter?

-------------------------------------------

[Chris Smith]

I am using 8.0.3. 

-------------------------------------------

[snapfriend]

Hello

There is already VMware article with same symptoms & description as mentioned below.

Every step & questions answered in an article. If it is relevant then please check the same. The below article applies to "VMware vCenter Server 8.0.x, VMware vCenter Server 6.x & VMware vCenter Server 7.0.x"

One of the question is answered in article as mentioned below & there are many more. 

Q:  Does vCenter use RC4 for encryption of Kerberos tickets?

A:  By default, vCenter offers AES128 and AES256 encryption.  The type of encryption used is determined by the server.  RC4 encryption is only used if the server does not support a better method.

Precautionary action -> Please take vCenter Snapshot & make sure backup is present already .. If you have test vCenter server then look into that as well if it is having same symptoms

https://knowledge.broadcom.com/external/article/344915/impact-of-rpc-sealing-enforcement-micros

-------------------------------------------

[Chris Smith]

I have gone through this article and a number of others. I have a open case with VMWare that we have been working on daily since last week and have made no progress as of yet which is why I am still looking for a solution. 

https://knowledge.broadcom.com/external/article/344879/customers-implementing-ms-november-patch.html
https://community.broadcom.com/vmware-cloud-foundation/discussion/change-vcenter-rc4-kerberos-tickets-to-aes#bme0844ec8-a838-44b9-a51f-4319aff0e02b
https://knowledge.broadcom.com/external/article/324328/login-to-vcenter-server-appliance-using.html#:~:text=Cause%20*%20This%20is%20expected%20behavior%20when,Kerberos%20authentication%20between%20VCSA%20and%20Active%20Directory.

I have also removed the server from AD and added it back. Changed from IWA to LDAP for SSO as part of the troubleshooting I have done with the support call. 
Thanks for looking at this. 

-------------------------------------------