Event ID's 5829-31 Not Visible in Domain Controller logs after August 2020 Patches

atekkof 21 Reputation points
2020-09-30T18:52:11.86+00:00

Hello, we have applied the August 2020 patches on our Domain Controllers but do not see any logs with Event ID 5829-5831 since the updates. There is at least one Server 2003 machine (i.e. out of support OS) on our domain which I assume is still using insecure Netlogon but I can't confirm this as I don't see it reflected anywhere in the logs.

My suspicion was that we might have to enable and configure the included GPO: "Domain controller: Allow vulnerable Netlogon secure channel connections", but I don't want to enable it and then "allow" vulnerable connections just to test this.

We also have non-Windows devices on our domain and I'm sure some of them are using insecure Netlogon connections to the DC's. Does anyone know how I can get the results I need in event viewer? I would like to be ready for the enforcement phase in February.

Thanks.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,771 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,176 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,899 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,729 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,381 questions

6 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. atekkof 21 Reputation points
    2020-10-08T13:01:05.663+00:00

    sganesamoorhty-0877 - from the link you posted:

    Is the August 2020 patch will affect the non-secure clients?

    NO: There is no impact as this is Enforcing secure RPC usage only for the Windows based devices which is supported natively without any outage unless you have very old legacy Windows Operating systems (OS)

    "Windows 2000 and above are not impacted"

    That seems to answer the questions about Server 2003, but I do have non-Windows devices running as well. I guess I'm fully patched and I can just dig my head in the sand from here on out.

    The "Test-ComputerSecureChannel" CMD would be great if it could be run against all machines in a domain without Powershell remoting to each one. I guess I"ll wait until Nessus has a module that can test this.

    Thanks a lot for all the help guys.

    0 comments
  2. DonPick 1,256 Reputation points
    2020-10-03T00:27:10.467+00:00

    https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc states in the FAQ section that WS2008SP1 is not vulnerable as it doesn't use AES for secure RPC.
    So it could also be true that WS2003 doesn't use it either, so it's not vulnerable to this? If so, then that's why you're not seeing any events logged?

    You could use wireshark or netmon or message analyser, to capture the packets, and analyse the cipher in use?

  3. Dave Patrick 426.1K Reputation points MVP
    2020-10-01T15:52:15.453+00:00

    On the suspect machines you can confirm via PowerShell
    Test-ComputerSecureChannel
    https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

    As to Server 2003 its unlikely to apply unless it use AES for Secure RPC
    https://support.microsoft.com/en-us/help/3050509/improving-cipher-security-in-windows-server-2003-sp2

    This specific CVE only applies to AES for Secure RPC

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments
  4. atekkof 21 Reputation points
    2020-10-01T15:50:02.207+00:00

    Yes, I'm aware of the information in that link and the description of how it is supposed to work, but there are no logs being generated for any of those Event ID's, so I can't tell if any machines on my network are using vulnerable netlogon to communicate. My concern is more for the out of support operating systems such as the Server 2003 machine on my domain which I suspect is using the old protocol, but I can't confirm this because the logging doesn't seem to be working properly. Is there an event ID which would confirm that secure RPC is being used by that machine?

    0 comments