Zerologon: patch your domain controllers now
A bug in Netlogon lets anyone on the network become domain admin in seconds. The August patch fixes it.
Last week researchers published details of Zerologon (CVE-2020-1472), a flaw in the Netlogon protocol. Anyone who can reach a domain controller on the network can reset its machine account password and take over the domain. In seconds, with no login. Exploit code is now public.
Microsoft fixed it in the August updates. If your domain controllers didn’t get those, this is the most urgent thing you’ll do this month.
- Install the August (or later) updates on every domain controller.
- Check none were missed: old ones, DCs at branch offices, test domains.
- Watch the event logs Microsoft lists for vulnerable connections, and fix devices that need them.
- Plan for the enforcement phase Microsoft announced for next year, when old insecure connections will be refused.
Ransomware groups will use this quickly. Anyone already inside your network can become the domain admin.