Does anyone have a slick way to duplicate ADUC aes128/256 checkboxes?

An enhancement request (TF00767049) has existed for a little while now for adding this to Active Roles. I'm not aware of any hidden controls or slick way to show these in the WI. In the meantime, it looks like this may need to be either virtual attributes and manipulation of the msDS-SupportedEncryptionTypes attribute or simply show this attribute on the WI and perform numeric value checks on it (0, 8, 18 or 26).

Such a smart feller, there Richard.  At least that's a jumping point for a further thought-exercise.  Boolean VA's I assume, tied to some scripting (meaning math …<worried look>) ….

thanks for the reply.

Such a smart feller, there Richard.  At least that's a jumping point for a further thought-exercise.  Boolean VA's I assume, tied to some scripting (meaning math …<worried look>) ….

thanks for the reply.

This thread has a PowerShell script which does all of the heavy lifting:

https://serverfault.com/questions/616487/why-dont-active-directory-user-accounts-automatically-support-kerberos-aes-auth

# The numerical values for Kerberos AES encryption types to support
$AES128 = 0x8
$AES256 = 0x10

# Fetch all users from an OU with their current support encryption types attribute
$Users = Get-ADUser -Filter * -SearchBase "OU=SecureUsers,OU=Users,DC=domain,DC=tld" -Properties "msDS-SupportedEncryptionTypes"
foreach($User in $Users)
{
    # If none are currently supported, enable AES256
    $encTypes = $User."msDS-SupportedEncryptionType"
    if(($encTypes -band $AES128) -ne $AES128 -and ($encTypes -band $AES256) -ne $AES256)
    {
        Set-ADUser $User -Replace @{"msDS-SupportedEncryptionTypes"=($encTypes -bor $AES256)}
    }
}

It shouldn't be too hard to modify this for use with Active Roles, triggered by Boolean Virtual Attributes.

if(($encTypes -band $AES128) -ne $AES128 -and ($encTypes -band $AES256) -ne $AES256)

and there's the one-two punch.  That - I can understand.  This line does the math - so I don't have to.  This is good-enough

- until the UI incorporates the change officially.

Thanks Rich and Terrance!