Quote from Karen Hewitt on April 29, 2026, 10:44 am

Several users have been seeing an issue with Distribution Credentials configured in Reportworq related to connectivity to IBM PA. The id and credentials that were previously working suddenly stop being able to connect post a Windows Update KB5073381.

CAUSE:

KB5073381 continues Microsoft's deprecation of the RC4 Kerberos encryption cipher. RC4 was considered insecure as far back as 2015, and Microsoft has been progressively removing support for it.

After this update, any service account that has not had its supported encryption types explicitly defined in Active Directory defaults to RC4 only, which the KDC will now refuse.

This affects the IBM Cognos Analytics service account, the Cognos admin account, and any other domain account involved in PA authentication.

Reference: KB5073381

RESOLUTION:

For each affected service account (Cognos service account, Cognos admin account, and any domain account configured in Reportworq Distribution credentials):

1. Open Active Directory Users and Computers and navigate to the account's properties.
2. On the Account tab, under "This account supports the following Kerberos encryption types," check the appropriate boxes (AES128, AES256, and RC4 if needed for legacy compatibility). Equivalent to setting `msDS-SupportedEncryptionTypes` to `28` via attribute editor or PowerShell. (For visual example see attached picture).
3. Reset the password for the service account.
4. Update the new password in every service and application using the account, including IBM Cognos services and Reportworq Distribution credentials.

Important: The encryption type changes do not take effect until the account password is reset and propagated to dependent services.