If DCs have AES configured via GPO, clients inherit AES even if their attribute is empty/0. Impact: You do NOT need to populate msDS-SupportedEncryptionTypes on 100,000+ computers if your DCs are ...