Guidance on CVE-2020-1472 - GPO - Allow vulnerable Netlogon secure channel connections - Security descriptor

Question

In reference to the Microsoft article below on the recent Netlogon CVE, we have patched and not seen any events associated with step 2 and plan to proceed with enabling enforcement mode. I expected the Allow vulnerable Netlogon secure channel connections GPO to be a simple enable/disable option but it has a security descriptor setting. This seems to default to allow administrators or do I want to just leave it blank to disallow all vulnerable connections?

its also not clear to me whether the GPO and Reg key are require or if its an either or

any guidance from experience with enabling enforcement mode would be appreciated

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc#theGroupPolicy

Answer 1

For the suspect clients you can confirm them via PowerShell
Test-ComputerSecureChannel
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Hi,
 
Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.
 
Best Regards,
Vicky