I want to authenticate with Kerberos AES 128-bit encryption on Windows Server 2016.

In Windows Server 2016 AD, any user can:
Active Directory Users and Computers > Select Any User > Properties > Account > Account Options > Check to support Kerberos AES 128-bit encryption for this account

Kerberos authentication with the above user results in a KRB5KDC_ERR_ETYPE-NOSUPP response.
I'd like to authenticate with AES 128 bits, do you know how to resolve the error?
*I do not want to authenticate with other encryption methods (such as AES256).