learn.microsoft.com Open in urlscan Pro
2600:141b:1c00:2487::3544  Public Scan

Submitted URL: https://go.microsoft.com/fwlink/?linkid=851152
Effective URL: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/syskey-exe-utility-is-no-longer-supported
Submission: On August 25 via manual from CA — Scanned from US

Form analysis 3 forms found in the DOM

Name: site-header-search-form-mobileGET /en-us/search/

<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form-mobile" data-bi-name="site-header-search-form-mobile" name="site-header-search-form-mobile" aria-label="Search" action="/en-us/search/">
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control ">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input-mobile"
        data-test-id="site-header-search-autocomplete-input-mobile" class="autocomplete-input input 
						
						width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-1-listbox" aria-controls="ax-1-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-mobile-description"
        placeholder="Search" data-bi-name="site-header-search-autocomplete-input-mobile" pattern=".*">
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-header-search-autocomplete-input-mobile-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-1-listbox" data-test-id="site-header-search-autocomplete-input-mobile-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

Name: site-header-search-formGET /en-us/search/

<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form" data-bi-name="site-header-search-form" name="site-header-search-form" aria-label="Search" action="/en-us/search/">
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control ">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input" data-test-id="site-header-search-autocomplete-input" class="autocomplete-input input input-sm
						
						width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-0-listbox" aria-controls="ax-0-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-description"
        placeholder="Search" data-bi-name="site-header-search-autocomplete-input" pattern=".*">
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-header-search-autocomplete-input-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-0-listbox" data-test-id="site-header-search-autocomplete-input-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

javascript:

<form action="javascript:" role="search" aria-label="Search" class="margin-bottom-xxs"><label class="visually-hidden" for="ax-2">Search</label>
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control has-icons-left">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="ax-2" data-test-id="ax-2" class="autocomplete-input input input-sm
						control has-icons-left
						width-full" type="text" aria-expanded="false" aria-owns="ax-3-listbox" aria-controls="ax-3-listbox" aria-activedescendant="" aria-describedby="ms--ax-2-description" placeholder="Filter by title" pattern=".*">
      <span aria-hidden="true" class="icon is-small is-left">
        <span class="has-text-primary docon docon-filter-settings"></span>
      </span>
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--ax-2-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-3-listbox" data-test-id="ax-2-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
</form>

Text Content

Skip to main content


This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security
updates, and technical support.

Download Microsoft Edge More info about Internet Explorer and Microsoft Edge

Learn
Suggestions will filter as you type
Sign in


 * Profile
 * Settings

Sign out

Learn
   
 * Discover
      
    * Documentation
      
      In-depth articles on Microsoft developer tools and technologies
   
      
    * Training
      
      Personalized learning paths and courses
   
      
    * Credentials
      
      Globally recognized, industry-endorsed credentials
   
      
    * Q&A
      
      Technical questions and answers moderated by Microsoft
   
      
    * Code Samples
      
      Code sample library for Microsoft developer tools and technologies
   
      
    * Assessments
      
      Interactive, curated guidance and recommendations
   
      
    * Shows
      
      Thousands of hours of original programming from Microsoft experts
   
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Product documentation
      
    * ASP.NET
      
    * Azure
      
    * Dynamics 365
      
    * Microsoft 365
      
    * Microsoft Edge
      
    * Microsoft Entra
      
    * Microsoft Graph
      
    * Microsoft Intune
      
    * Microsoft Purview
      
    * Microsoft Teams
      
    * .NET
      
    * Power Apps
      
    * Power Automate
      
    * Power BI
      
    * Power Platform
      
    * PowerShell
      
    * SQL
      
    * Sysinternals
      
    * Visual Studio
      
    * Windows
      
    * Windows Server
      
   
   View all products
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Development languages
      
    * C++
      
    * C#
      
    * DAX
      
    * Java
      
    * OData
      
    * OpenAPI
      
    * Power Query M
      
    * VBA
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Topics
      
    * Artificial intelligence
      
    * Compliance
      
    * DevOps
      
    * Platform engineering
      
    * Security
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   

Suggestions will filter as you type
Sign in


 * Profile
 * Settings

Sign out
Windows Server
   
 * Get started
   
 * Failover clustering
   
 * Management
   
 * Identity and access
   
 * Networking
   
 * Troubleshooting
   
 * Related products
     
   * IIS
     
   * Remote Desktop
     
   * Hyper-V
     
   * Windows Server Essentials
     
   
 * More
     
   * Get started
     
   * Failover clustering
     
   * Management
     
   * Identity and access
     
   * Networking
     
   * Troubleshooting
     
   * Related products
       
     * IIS
       
     * Remote Desktop
       
     * Hyper-V
       
     * Windows Server Essentials
       
     
   

Table of contents Exit focus mode

Search
Suggestions will filter as you type
 * Windows Server
 * Active Directory
   * Active Directory
   * Active Directory backup, restore, or disaster recovery
     * c00002e2 error or "Choose an option" is displayed
     * Directory Services event 2095 when USN rollback occurs
     * Event 2089 if you don't back up a domain controller
     * How to remove orphaned domains
     * How to restore deleted user accounts and their groups
     * No logon servers are available
     * Offline defragmentation of Active Directory database
     * Relocate a SYSVOL tree
     * RODC replicates passwords
     * Syskey.exe utility is no longer supported
     * SYSVOL folder isn't replicated between domain controllers
   * Active Directory database issues and domain controller boot failures
   * Active Directory domain or forest functional level updates
   * Active Directory Federation Services (AD FS)
   * Active Directory FSMO
   * Active Directory Lightweight Directory Services (AD LDS) and Active
     Directory Application Mode (ADAM)
   * Active Directory Migration Tool (ADMT)
   * Active Directory replication
   * Active Directory Rights Management Services
   * Active Directory topology (sites, subnets, and connection objects)
   * DCPromo and the installation of domain controllers
   * Domain controller scalability or performance (including LDAP)
   * Domain join issues
   * LDAP configuration and interoperability
   * Schema update failure or conflict
   * User, computer, group, and object management
   * Virtualized domain controller (errors and questions)
   * Windows Time Service
 * Admin Development
 * Application Management
 * Backup and Storage
 * Certificates and Public Key Infrastructure (PKI)
 * Containers
 * Group Policy
 * High Availability
 * Licensing and activation
 * Networking
 * Performance
 * Printing
 * Remote Desktop Services
 * Resources
 * Security and Malware
 * Setup, upgrades, and drivers
 * Shell Experience
 * Software Defined Networking
 * System Management Components
 * UserProfiles and Logon
 * Virtualization
 * Windows Security
 * Windows Servicing, Updates and Features on Demand
 * Windows Server End of Support (EoS) FAQ
 * Support Tools

Download PDF
    
 1. Learn
    
    
 2. Troubleshoot
    
    
 3. Windows
    
    
 4. Windows Server
    

    
 1. Learn
    
    
 2. Troubleshoot
    
    
 3. Windows
    
    
 4. Windows Server
    

Read in English Save
 * Add to Collections
 * Add to Plan

Table of contents Read in English Add to Collections Add to Plan Edit


--------------------------------------------------------------------------------

SHARE VIA

Facebook x.com LinkedIn Email

--------------------------------------------------------------------------------

Print
Table of contents


SYSKEY.EXE UTILITY IS NO LONGER SUPPORTED IN WINDOWS 10, WINDOWS SERVER 2016,
AND LATER VERSIONS

 * Article
 * 02/19/2024
 * 2 contributors

Feedback


IN THIS ARTICLE

    
 1. Changes detail
    
 2. Workaround
    
 3. More information
    
 4. Reference
    

Windows 10, version 1709, Windows Server, version 2004 and later versions of
Windows no longer support the syskey.exe utility.

Applies to:   Windows 10 - all editions, Windows Server 2019, Windows Server
2016
Original KB number:   4025993


CHANGES DETAIL

The following changes are made:

 * The syskey.exe utility is no longer included in Windows.
 * Windows will never prompt for a syskey password during startup.
 * Windows will no longer support installing an Active Directory domain
   controller by using Install-From-Media (IFM) that was externally encrypted by
   the syskey.exe utility.

If an operating system (OS) was externally encrypted by the syskey.exe utility,
you can't upgrade it to Windows 10 version 1709, Windows Server version 2004, or
a later version of Windows.


WORKAROUND

If you want to use boot-time OS security, we recommend that you use BitLocker or
similar technologies instead of the syskey.exe utility.

If you use Active Directory IFM media to install replica Active Directory domain
controllers, we recommend that you use BitLocker or other file encryption
utilities to protect all IFM media.

To upgrade an OS that's externally encrypted by the syskey.exe utility to
Windows 10 RS3 or Windows Server 2016 RS3, the OS should be configured not to
use an external syskey password. For more information, see step 5 in How to use
the SysKey utility to secure the Windows Security Accounts Manager database.


MORE INFORMATION

Syskey is a Windows internal root encryption key that's used to encrypt other
sensitive OS state data, such as user account password hashes. The SysKey
utility can be used to add an extra layer of protection, by encrypting the
syskey to use an external password. In this state, the OS blocks the boot
process and prompt users for the password (either interactively or by reading
from a floppy disk).

Unfortunately, the syskey encryption key and the use of syskey.exe are no longer
considered secure. Syskey is based on weak cryptography that can easily be
broken in modern times. The data that's protected by syskey is limited and
doesn't cover all files or data on the OS volume. The syskey.exe utility has
also been known to be used by hackers as part of ransomware scams.

Active Directory previously supported the use of an externally encrypted syskey
for IFM media. When a domain controller is installed by using IFM media, the
external syskey password had to be provided as well. Unfortunately, this
protection suffers from the same security flaws.


REFERENCE

The syskey.exe utility and its underlying support in the Windows OS was first
introduced in Windows 2000 and backported to Windows NT 4.0. For more
information, see How to use the SysKey utility to help secure the Windows
Security Accounts Manager database.





--------------------------------------------------------------------------------


FEEDBACK

Was this page helpful?

Yes No
Provide product feedback

--------------------------------------------------------------------------------


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Explore advanced protection methods - Training

This module explores additional tools used to provide additional layers of
security within an organization.



English (United States)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * 
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Explore advanced protection methods - Training

This module explores additional tools used to provide additional layers of
security within an organization.




IN THIS ARTICLE



English (United States)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * 
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024