CVE-2020-1472 Netlogon Secure clarifications

Question

Hi,

Unfortunately, our environment is a mix bag of Windows 7, 8 , 8.1 and 10 systems. Ever since we have updated the Aug patch, we are observing number of events for 5827, 5828 and 5829. Request if below can be clarified:

1. Are the events 5827 and 5828 being generated for the outdated versions of the system i.e. Win 7, 8 and 8.1. Also whether monitoring of these events is required or just monitoring for 5829?
2. How can we configure these Operating systems to prevent such deny connection from DC.
   3. Post Feb upgrade, will these devices be not able to connect to DC even though the above settings have been applied

Regards
Arun

Answer 1

You can test from the client end
Test-ComputerSecureChannel
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

You can put them in an OU, then add the OU here on each domain controller.
https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc#theGroupPolicy

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Thanks Patrick, however is there any other way to mitigate or lower the RISK rather than create a OU.

Also, there as per the article the secure channel will be enforced irrespective of the bit in registry. In such a case, having an separate OU will work?

Regards
Arun

Answer 3

The desktop operating systems Windows 8 and higher you mentioned should support secure channel. I'd check they're patched fully. Then use
Test-ComputerSecureChannel
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1
to confirm.

For any that are non-compliant you'll need to explicitly allow by adding an exception for the non-compliant device

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

To learn more about the vulnerability, see CVE-2020-1472.

Take Action

To protect your environment and prevent outages, you must do the following:

UPDATE your Domain Controllers with an update released August 11, 2020 or later.
FIND which devices are making vulnerable connections by monitoring event logs.
ADDRESS non-compliant devices making vulnerable connections.
ENABLE enforcement mode to address CVE-2020-1472 in your environment.
Note Step 1 of installing updates released August 11, 2020 or later will address security issue in CVE-2020-1472 for Active Directory domains and trusts, as well as Windows devices. To fully mitigate the security issue for third-party devices, you will need to complete all the steps.

Warning Starting February 2021, enforcement mode will be enabled on all Windows Domain Controllers and will block vulnerable connections from non-compliant devices. At that time, you will not be able to disable enforcement mode.

reference：https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

Hope this information can help you
Best wishes
Vicky

Answer 5

Hi ,

I have some question about this patch
My customer did the august patch on their 90 000 devices and DC but on their 90 000 , 1000 of these devices have not the following registry key : FullSecureChannelProtection
Why ? after some explaination it seems this registry key is not mandatory (but mu question, the registry key is set automatically after the august patch ?

I'm sorry if it's not clear..
Thanks