Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?
I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the user's NT hash as the encryption key for requesting a TGT ticket.
The recommendation seems to be to upgrade from RC4 to AES. But why is this more secure?
Indeed, AES is stronger encryption than RC4, but can't the attacker still request a TGT on behalf of a specific user by obtaining the user's NT hash?
Please correct me, if some details are wrong.