18.8.25.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic' - Behavior

[pillarsdotnet]

18.8.25.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic'

Info

This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.
Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts.
The recommended state for this setting is: 'Enabled: Automatic'.
Rationale:
Having stronger device authentication with the use of certificates is strongly encouraged over standard username and password authentication. Having this set to Automatic will allow certificate based authentication to be used whenever possible.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Enabled: Automatic':
Computer Configuration\Policies\Administrative Templates\System\Kerberos\Support device authentication using certificate
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template 'Kerberos.admx/adml' that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates (or newer).
Impact:
None - this is the default behavior.

See Support device authentication using certificate