diff --git a/include/NTMakefile b/include/NTMakefile
index 984984d4a..e93cf8461 100644
--- a/include/NTMakefile
+++ b/include/NTMakefile
@@ -61,6 +61,7 @@ while(<>) {
     if ("$(KRB5)") { print "#define KRB5 1\n"; }
     if ("$(KRB4)") { print "#define KRB4 1\n"; }
     if ("$(WEAK_CRYPTO)") { print "#define HEIM_WEAK_CRYPTO 1\n"; }
+    if ("$(HCRYPTO_FALLBACK)") { print "#define HCRYPTO_FALLBACK 1\n"; } else { print "#define HCRYPTO_FALLBACK 0\n"; }
     if ("$(PKINIT)") { print "#define PKINIT 1\n"; }
     if ("$(NO_AFS)") { print "#define NO_AFS 1\n"; }
     if ("$(OPENLDAP)") { print "#define OPENLDAP 1\n"; }
diff --git a/windows/NTMakefile.config b/windows/NTMakefile.config
index 429dce817..cea260ace 100644
--- a/windows/NTMakefile.config
+++ b/windows/NTMakefile.config
@@ -96,6 +96,9 @@ DIR_hdbdir=%{COMMON_APPDATA}/heimdal/hdb
 # Disable weak crypto
 WEAK_CRYPTO=0
 
+# Enable hcrypt fallback mechanisms
+HCRYPTO_FALLBACK=1
+
 # Disable use of GSS LOCALNAME support
 NO_LOCALNAME=1