Zerologon: Patch Every Domain Controller, Then Get Ready for February

Most Patch Tuesday bugs are about one machine. CVE-2020-1472 is about the domain. It lives in Netlogon on your domain controllers, and what’s at risk is Active Directory itself. Last Friday the Cybersecurity and Infrastructure Security Agency told federal civilian agencies to patch it over the weekend, and yesterday it said it was aware of active exploitation.

Secura, the security company whose researcher reported the bug to Microsoft, calls it Zerologon. I’m leaving out how the attack works. Microsoft and CISA are my sources for everything below, and the practical parts are my reading of Microsoft’s guidance, not something I’ve run in a production forest.

What Microsoft says the bug is

Microsoft’s Security Update Guide entry for CVE-2020-1472 calls it the Netlogon Elevation of Privilege Vulnerability. It describes an attacker establishing a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol, MS-NRPC, and says an unauthenticated attacker would use MS-NRPC to connect to a DC to obtain domain administrator access.

When the advisory went out in August, Microsoft rated it Critical and scored it CVSS 10.0 for each affected product: Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, and 2019, plus Server Core installations of versions 1903, 1909, and 2004. NIST’s NVD entry gives it a 10.0 as well.

The fix shipped on August 11 as the first half of a phased two-part rollout. Microsoft explains that there are many non-Windows implementations of Netlogon and their vendors need time to ship updates, so the second phase, the one that can break things, is planned for the first quarter of 2021.

The two phases, in Microsoft’s words

The details live in Microsoft’s support article KB4557222, “How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472”.

The initial deployment phase starts with the August 11, 2020 updates and runs through later monthly updates. Once a DC has it, the DC enforces secure RPC for machine accounts on Windows devices, for trust accounts, and for all domain controllers, Windows or not. Windows devices get protected by default. What doesn’t get forced yet is non-Windows domain members: their vulnerable connections are still allowed, but the DC now logs them so you can find them.

The enforcement phase is set for the February 9, 2021 updates. From then on, the KB says, DCs will be in enforcement mode whether you configured it or not, and every Windows and non-Windows device has to use secure RPC with the Netlogon secure channel unless you’ve explicitly allowed its account as an exception.

To protect the forest, the KB says every DC has to get the update, and it specifically includes read-only domain controllers. If your branch office RODCs get patched whenever someone remembers, they count here.

What CISA ordered

CISA issued Emergency Directive 20-04 on Friday, September 18. It describes MS-NRPC as a core authentication component of Active Directory and says the flaw could let an unauthenticated attacker with network access to a DC completely compromise all Active Directory identity services. CISA’s reasons for making it an emergency include exploit code being available, how many affected domain controllers exist across federal networks, the grave impact of a compromise, and the fact that the hole was still open more than 30 days after the update came out.

Agencies had until 11:59 PM EDT on Monday, September 21, to apply the August 2020 security update to every Windows Server with the domain controller role, and any DC that couldn’t be updated had to come off the network. By the same deadline they needed technical or management controls so that new or previously disconnected DCs get updated before they connect. Completion reports from department CIOs were due by 11:59 PM EDT on Wednesday, September 23. CISA also recommends confirming deployment with something beyond the usual vulnerability scanners.

The directive only binds federal civilian agencies, but CISA wants everyone patched. In a blog post the same day, Assistant Director Bryan Ware urged state and local governments, the private sector, and the public to apply the update as soon as possible, and to pull DCs off the network if they can’t. CISA’s activity alert that day said the agency assumes active exploitation is happening. On September 24, CISA’s follow-up alert went further and said it is aware of active exploitation, adding that until every domain controller is updated, “the entire infrastructure remains vulnerable.”

That’s the point to remember: patching most of your DCs doesn’t get you most of the protection.

Patch every DC, and prove it

My advice is to treat this the way CISA told agencies to. Build a list of every server holding the domain controller role across every domain in the forest, including RODCs, the small child domain nobody logs into, and the DC someone stood up in a cloud subscription last year. Then check each one for the August 11 security update or a later one rather than trusting a green dashboard. If a DC can’t be patched right now, CISA’s answer is to take it off the network, and I don’t see a better one.

Borrow the directive’s second requirement too. A DC restored from an old backup or built from a stale image comes back without the fix, so make sure new and restored DCs are updated before they rejoin the network.

Watch the Netlogon events

After the August update, patched DCs write new Netlogon events to the System log, Event 5829 is a warning that a vulnerable Netlogon secure channel connection from a machine account was allowed. These are the ones to chase now, because once enforcement mode is on, those same connections get denied. The event includes the machine account name, domain, and operating system details, which is usually enough to work out what the device is.

Events 5827 and 5828 are errors logged when a vulnerable connection from a machine account or a trust account is denied. Microsoft says fully updated, supported Windows shouldn’t produce these, so if one names a Windows machine, the KB says to confirm it’s on a supported, fully patched version and that the “Domain member: Digitally encrypt or sign secure channel data (always)” policy is enabled. Events 5830 and 5831 are warnings logged when a vulnerable connection from a machine or trust account is allowed only because it’s on the exception list. The KB suggests collecting them with event monitoring software or a script, and I’d do it across every DC, since each one only logs the connections it handled.

Find the non-Windows devices

Every 5829 points at something that joined your domain but isn’t a patched Windows machine. Microsoft’s recommended fix is to get secure RPC support for Netlogon from the device’s manufacturer or software vendor, turn it on if the device already supports it, or retire the device. Asking vendors now leaves them time before February.

For devices that can’t be fixed in time, the KB describes a group policy called “Domain controller: Allow vulnerable Netlogon secure channel connections”, configured with a security group whose members are allowed to keep making vulnerable connections. Microsoft is blunt that this puts those accounts at risk and should be a short-term measure until the device is updated. Allowing a trust account or a non-Windows DC this way, the KB warns, makes the whole forest vulnerable. I’d keep that group small, name an owner for each entry, and set a removal date.

Plan for enforcement

You don’t have to wait for February. The August update added a registry value that turns enforcement mode on early:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
FullSecureChannelProtection  REG_DWORD  1

With it set to 1, DCs deny vulnerable connections unless the account is in the allow policy, with no reboot needed. Microsoft’s order is to address every warning, make sure any allow policy has replicated to all DCs, and only then set the value, because third-party clients without secure RPC support will be refused and that can disrupt production services. Once the February 9, 2021 updates are installed, the value stops mattering, since enforcement is on regardless.

So the sequence I’d follow is: update every DC now, collect 5829 events from all of them for a few weeks, work through the devices they name, keep exceptions short and owned, and turn on enforcement mode yourself once the warnings stop. The Update Guide also says Microsoft will announce the second phase as a revision to the advisory, so subscribe to its security notifications if you don’t already.

This bug hands the domain to anyone who can reach an unpatched DC, CISA says it’s being used, and the fix is an update you already have. Put it on every domain controller today, and use the months before enforcement to find everything that still talks to Netlogon the old way.