Confusion regarding Event ID: 5829

Question

Hi

I have been referring to the CVE-1472 advisory

And am now a bit confused about the Event ID: 5829 in the initial deployment phase.
The article says that in the initial deployment phase, the default policy would be to deny vulnerable netlogon secure channels, unless the machines are added to group policy.

So I would expect events 5827 and 5828
And if the group policy is allowing vulnerable connections, I would expect events 5830 and 5831

Then in what case would I see events 5829. Is that only for non-windows based systems ?

Answer 1

Then in what case would I see events 5829. Is that only for non-windows based systems ?

Event ID 5829 is generated when a vulnerable connection is allowed during the initial deployment phase.
You can test from the client end from PowerShell
Test-ComputerSecureChannel

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

During the Initial Deployment Phase

• Begin enforcing secure RPC usage for all Windows-based device accounts, trust accounts and all DCs.
• Log event IDs 5827 and 5828 in the System event log, if connections are denied.
• Log event IDs 5830 and 5831 in the System event log, if connections are allowed by "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy.
• Log event ID 5829 in the System event log whenever a vulnerable Netlogon secure channel connection is allowed. These events should be addressed before the DC enforcement mode is configured or before the enforcement phase starts on February 9, 2021.

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Begin enforcing secure RPC usage for all Windows-based device accounts, trust accounts and all DCs so unsecure connections would be denied unless you added to the policy "Domain controller: Allow vulnerable Netlogon secure channel connections"

From cmd.exe run gpedit.msc then navigate to;

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

You'll see event ID 5829 in the System event log whenever a vulnerable Netlogon secure channel connection is allowed via the policy above.

--please don't forget to Accept as answer if the reply is helpful--

Answer 5

Might read through the FAQ in this document.
https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

--please don't forget to Accept as answer if the reply is helpful--