Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472)

What is affected, what to do

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update samba to version 4.10.18, directory_server to version 4.4.5-0101. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server version 2004 gte 10.0.0..*
• Microsoft Windows Server 2019 gte 10.0.0..*
• Microsoft Windows Server 2019 (Server Core installation) gte 10.0.0..*
• Microsoft Windows Server, version 1909 (Server Core installation) gte 10.0.0..*
• Microsoft Windows Server, version 1903 (Server Core installation) gte 10.0.0..*
• Microsoft Windows Server 2016 gte 10.0.0..*
• Microsoft Windows Server 2016 (Server Core installation) gte 10.0.0..*
• Microsoft Windows Server 2008 R2 Service Pack 1 gte 6.1.0..*
• Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) gte 6.0.0..*
• Microsoft Windows Server 2012 gte 6.2.0..*
• Microsoft Windows Server 2012 (Server Core installation) gte 6.2.0..*
• Microsoft Windows Server 2012 R2 gte 6.3.0..*
• Microsoft Windows Server 2012 R2 (Server Core installation) gte 6.3.0..*
• Microsoft Windows Server version 20H2 gte 10.0.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch every domain controller now: Apply the Microsoft security updates from August 2020 onward for CVE-2020-1472 to all DCs, including RODCs and DCs at branch or DR sites. Look up the exact KB per Windows Server version in the Microsoft advisory. A single unpatched DC is enough to lose the domain.
   • Confirm enforcement mode: Set or verify HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection = 1 (DWORD) on all DCs. It has been the default since the February 2021 updates. Inventory every exception granted via the GPO "Domain controller: Allow vulnerable Netlogon secure channel connections" and shrink that list.
   • Check for compromise before closing the ticket: Search the Security logs on all DCs retrospectively for Event ID 4742 (computer account changed) where the target is a DC machine account and the subject is ANONYMOUS LOGON. A hit means Zerologon succeeded. Escalate to full incident response rather than just patching.
   • If exploitation is confirmed: Reset the krbtgt password twice, allowing replication between resets. Reset the affected DC's machine account password (netdom resetpwd). Rotate all privileged accounts (Domain/Enterprise Admins, service accounts) and hunt for DCSync activity.
   • Check embedded-Windows third-party systems: The context lists Schneider Electric with Windows 10. Inventory domain-joined OT, HMI and engineering workstations and verify their patch level against the Schneider Electric advisory. Patch available from the vendor — look up the version in the vendor advisory.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Restrict DC reachability on RPC (TCP 135, dynamic RPC 49152–65535) and SMB (TCP 445, \netlogon named pipe) to subnets that actually hold domain members. Guest Wi-Fi, non-domain OT zones, third-party VPN pools and the DMZ should never reach DCs directly.
   • IPS/NDR signatures: Enable the Zerologon rules in your Suricata/Snort ruleset (ET Open or equivalent rules referencing CVE-2020-1472). These match NetrServerAuthenticate calls with an all-zero client credential and rapid repetition. Run them in blocking mode where you are inline.
   • Configuration hardening: Fix devices that generate 5829 events with a firmware upgrade or replace them, rather than allow-listing them via GPO. Track every remaining exception with an owner and an expiry date in the risk register (ISO 27001 A.8.8).
   • IAM / least privilege: Enforce an AD tiering model (Tier 0 = DCs and AD admins). Allow admin logons to Tier 0 only from PAWs. Limit replication rights (DS-Replication-Get-Changes-All) to DCs and sanctioned sync accounts such as Entra Connect.
   • Endpoint hardening: Run EDR with credential-theft protection on every DC. Enable LSA Protection (RunAsPPL) to raise the cost of follow-on credential dumping.
3. 03

   Runbook step 3

   Detection rules

   • Windows System log, source NETLOGON: Event IDs 5827/5828 (vulnerable connection denied for machine or trust account), 5829 (vulnerable connection allowed) and 5830/5831 (allowed via GPO exception). KQL: Event | where Source == "NETLOGON" and EventID in (5827,5828,5829,5830,5831) | summarize count() by Computer, RenderedDescription.
   • Security log, DC account password reset: Event ID 4742 with SubjectUserName = ANONYMOUS LOGON and a TargetUserName that is a DC account ending in $. Sigma shape: EventID: 4742, SubjectUserName: 'ANONYMOUS LOGON', TargetUserName|endswith: '$'. Treat as a critical alert.
   • Network telemetry (Zeek dce_rpc.log): Look for a burst of NetrServerReqChallenge/NetrServerAuthenticate3 calls from one source (hundreds of attempts), followed by NetrServerPasswordSet2. SPL: index=zeek sourcetype=dce_rpc operation=NetrServerAuthenticate3 | bin _time span=1m | stats count by _time, id.orig_h | where count > 20.
   • Follow-on DCSync: Event ID 4662 showing access to the replication GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 / 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 by a non-DC account. Correlate with DRSUAPI traffic from non-DC hosts in Zeek.
   • EDR process ancestry: Flag Mimikatz (lsadump::zerologon, lsadump::dcsync) or Impacket (secretsdump.py) on workstations and member servers. Also flag python.exe/powershell.exe making outbound RPC to DCs from non-admin hosts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Source: schneider_csaf, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Canonical Canonical Ubuntu Linux
• Debian Debian Linux
• Fedoraproject Fedora
• Microsoft Windows Server 1903
• Microsoft Windows Server 1909
• Microsoft Microsoft Windows Server 2004
• Microsoft Microsoft Windows Server 2008
• Microsoft Windows Server 2008 R2 Service Pack 1
• Microsoft Windows Server 2008 R2 Service Pack 1 (server Core Installation)
• Microsoft Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2012 R2 (server Core Installation)

References & sources

• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2020-1472x_refsource_MISC, Patch, Vendor advisory
• kb.cert.orgVU#490028Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource
• openwall.com[oss-security] 20200917 Samba and CVE-2020-1472 ("Zerologon")Mailing list, x_refsource_MLIST, Mailing list, Third-party advisory
• usn.ubuntu.comUSN-4510-1Vendor advisory, x_refsource_UBUNTU, Third-party advisory
• usn.ubuntu.comUSN-4510-2Vendor advisory, x_refsource_UBUNTU, Third-party advisory
• lists.fedoraproject.orgFEDORA-2020-0be2776ed3Vendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• lists.opensuse.orgopenSUSE-SU-2020:1513Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• lists.opensuse.orgopenSUSE-SU-2020:1526Vendor advisory, x_refsource_SUSE, Mailing list, Third-party advisory
• lists.fedoraproject.orgFEDORA-2020-77c15664b0Vendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• lists.fedoraproject.orgFEDORA-2020-a1d139381aVendor advisory, x_refsource_FEDORA, Mailing list, Third-party advisory
• usn.ubuntu.comUSN-4559-1Vendor advisory, x_refsource_UBUNTU, Third-party advisory
• lists.debian.org[debian-lts-announce] 20201123 [SECURITY] [DLA 2463-1] samba security updateMailing list, x_refsource_MLIST, Mailing list, Third-party advisory
• security.gentoo.orgGLSA-202012-24Vendor advisory, x_refsource_GENTOO, Third-party advisory
• oracle.comsecurity-alerts/cpuApr2021.htmlx_refsource_MISC, Patch, Third-party advisory
• packetstormsecurity.comfiles/159190/Zerologon-Proof-Of-Concept.htmlx_refsource_MISC, Third-party advisory, Vulnerability database
• synology.comsecurity/advisory/Synology_SA_20_21x_refsource_CONFIRM, Third-party advisory
• packetstormsecurity.comfiles/160127/Zerologon-Netlogon-Privilege-Escalation.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472government-resource, US government resource
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2020-ALE-020 – [MàJ] Vulnérabilité dans Microsoft Netlogon (clôturée 2021-03-11)cert-fr
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2020-ALE-021 – Vulnérabilité dans Samba (clôturée 2021-03-11)cert-fr