spn kerberos encoding types

Hi,

I have created a 'services' user according to the instructions of Samba 
Wiki to enable spn for a server. I defined in RSAT tool from Windows 
side use of enhanced kerberos security types that show in net ads enctypes:

'services' uses "msDS-SupportedEncryptionTypes": 28 (0x0000001c)
[ ] 0x00000001 DES-CBC-CRC
[ ] 0x00000002 DES-CBC-MD5
[X] 0x00000004 RC4-HMAC
[X] 0x00000008 AES128-CTS-HMAC-SHA1-96
[X] 0x00000010 AES256-CTS-HMAC-SHA1-96
[ ] 0x00000020 AES256-CTS-HMAC-SHA1-96-SK
[ ] 0x00080000 RESOURCE-SID-COMPRESSION-DISABLED

Yet if I create a spn and export keytable with:

samba-tool domain exportkeytab --principal <spn_type>/domain.com 
somefile.keytab

  the content is:

KVNO Principal
---- 
--------------------------------------------------------------------------
    2 
nfs/[email protected] 
(DEPRECATED:arcfour-hmac)

How would one define that spn gets enhanced encoding types in command:

samba-tool spn add  <spn_type>/domain.com <service_user>

If the <service_user> has the high encryption types already on?

-- 
Sami Hulkko
+358 45 8569 319
[email protected]
[email protected]


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba