Netlogon Secure Channel CVE-2020-1472 Clarification Needed

Question

Regarding the August 11th patch that addresses CVE-2020-1472: After reading through the article below I am not clear on whether access will be denied for certain clients or if this patch is just adding event monitoring only and Feb 2021 update is for enforcement?

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

Jason

Answer 1

Hello @Jason Leidy ,

Thank you for posting here.

After reading several times , here are the answers for your references.

Q1:What happens when I install the August patch on all of my clients (all Windows 10 1909) and servers.
A1:We only need to install the August patch on all DCs in the forest.

All will happen below after you install the August patch on all DCs in the forest.

1.After deploying the August 11th updates to all DCs (including Windows DCs (including read-only domain controllers) and non-Windows DCs) in the forest.

2.By default, supported versions of Windows that have been fully updated should not be using vulnerable Netlogon secure channel connections.

3.Detecting non-compliant devices using event ID 5829.

3-1 Monitor patched DCs for event ID 5829 events.
3-2 The event ID 5829 determines which devices in your environment are using vulnerable Netlogon secure channel connections (referred to as non-compliant devices in that article).
3-3 The events will include relevant information for identifying the non-compliant devices.

4.To find non-compliant devices (A non-compliant device is one that uses a vulnerable Netlogon secure channel connection.) in advanve from event ID 5829 on all DCs before we install February 9, 2021 updates.

4-1 Deploying the August 11th updates to all DCs
4-2 Monitor patched DCs for event ID 5829 events. Event ID 5829 is generated when a vulnerable connection is allowed during the initial deployment phase.
4-3 To resolve the vulnerable Netlogon secure channel connections(enforce secure RPC when using the Netlogon secure channel ), move to enforcement mode in advance of the February 2021 enforcement phase

Method 1
Set Registry on all DCs.
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: FullSecureChannelProtection
Data type: REG_DWORD
Value:1 – This enables enforcement mode.
DCs will deny vulnerable Netlogon secure channel connections unless the account is allowed by the Create Vulnerable Connection list in the "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy.

Method 2
Wait for February 9, 2021 updates

Q2:Non-compliant machines won't be able to get logged on?
A2:If we only install August 11, 2020 updates, non-compliant machines will be able to get logged on. Event ID 5829 is generated when a vulnerable connection is allowed during the initial deployment phase. These connections will be denied when DCs are in enforcement mode.

Q3:I don't know which devices are non-compliant (not using secure RPC when using the Netlogon secure channel).
A3:To find non-compliant devices in advanve after August 11, 2020 updates before we install February 9, 2021 updates.

1 Deploying the August 11th updates to all DCs.
2 Monitor patched DCs for event ID 5829.

Q4:How is that different than what the February update does.
A4:
August 11, 2020 updates - Initial Deployment Phase
We can find non-compliant machines in advance from event ID 5829 on all DCs before we install February 9, 2021 updates.

February 9, 2021 updates - Enforcement Phase (make FullSecureChannelProtection=1 on all DCs forcely)

If we actually find some non-compliant devices and we want "the Netlogon service allow vulnerable Netlogon secure channel connection from a machine account", we should set "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy for Domain Controllers.

Domain controller: Allow vulnerable Netlogon secure channel connections ==> Allow: The domain controller will allow the specified group/accounts to use a Netlogon secure channel without secure RPC.

After that, we may receive Event ID 5830 and Event ID 5831.

Event ID 5830 will be logged when a vulnerable Netlogon secure channel machine account connection is allowed by "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy.

Event ID 5831 will be logged when a vulnerable Netlogon secure channel trust account connection is allowed by "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy.

Otherwise, we actually find some non-compliant devices, and we want "the Netlogon service deny vulnerable Netlogon secure channel connection from a machine account" and we does not set "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy for Domain Controllers, we may receive Event ID 5827 and Event ID 5828.

Event ID 5827 will be logged when a vulnerable Netlogon secure channel connection from a machine account is denied.
Event ID 5828 will be logged when a vulnerable Netlogon secure channel connection from a trust account is denied.

Hope the information above is helpful. If anything is unclear, please feel free to let un know.

Best Regards,
Daisy Zhou

Answer 2

The August 11, 2020 update transitions to Initial Deployment Phase (monitoring)

The February 9, 2021 update transitions into the enforcement phase. The DCs will now be in enforcement mode regardless of the enforcement mode registry key. This requires all Windows and non-Windows devices to use secure RPC with Netlogon secure channel or explicitly allow the account by adding an exception for the non-compliant device. 

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hi

This KB is recommended to enforce the security communication between domain controller and member machine.
You can find the explanation in the summary:

**These updates enforce the specified Netlogon client behavior to use secure RPC with Netlogon secure channel between member computers and Active Directory (AD) domain controllers (DC). **

This security update addresses the vulnerability by enforcing secure RPC when using the Netlogon secure channel **

Don't forget to mark this reply as answer if it help you to fix your issue

Answer 4

Hello @Jason Leidy ,

Thank you for posting here.

Here are the answers for your references.

Q: I am not clear on whether access will be denied for certain clients or if this patch is just adding event monitoring only and Feb 2021 update is for enforcement?

A: The updates will be released in two phases: the initial phase for updates released on or after August 11, 2020 and the enforcement phase for updates released on or after February 9, 2021.

The initial phase for updates:

If you have non-compliant devices, the access will be denied. Then event ID 5827, 5828 and 5829 may be logged.

1.Event ID 5827 will be logged when a vulnerable Netlogon secure channel connection from a machine account is denied.

2.Event ID 5828 will be logged when a vulnerable Netlogon secure channel connection from a trust account is denied.

3.Update will include a new group policy to allow non-compliant device accounts (those that use vulnerable Netlogon secure channel connections). Even when DCs are running in enforcement mode or after the Enforcement phase starts, allowed devices will not be refused connection.

Event ID 5829 will only be logged during the Initial Deployment Phase, when a vulnerable Netlogon secure channel connection from a machine account is allowed (gpo setting).

When DC enforcement mode is deployed or once the Enforcement phase starts with the deployment of the February 9, 2021 updates, these connections (5729) will be denied and Event ID 5827 will be logged. This is why it is important to monitor for Event 5829 during Initial Deployment Phase and act prior to Enforcement phase to avoid outages.

Make DCs in enforcement mode

Method 1 ==> set the following registry value manually

FullSecureChannelProtection registry key to enable DC enforcement mode for all machine accounts (enforcement phase will update DCs to DC enforcement mode).

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection
REG_DWORD

1 – This enables enforcement mode.

0 – DCs will allow vulnerable Netlogon secure channel connections from non-Windows devices. This option will be deprecated in the enforcement phase release.

Method 2 ==> install update ==> February 9, 2021 - Enforcement Phase

The DCs will now be in enforcement mode regardless of the enforcement mode registry key. This requires all Windows and non-Windows devices to use secure RPC with Netlogon secure channel or explicitly allow the account by adding an exception for the non-compliant device. 

We can monitor 5827, 5828 and 5829 after the initial phase for updates installed. Then we may find non-compliant devices through event ID 5827, 5828 and 5829.

Hope the information above is thelpful.

Best Regards,
Daisy Zhou

Answer 5

Yes, the August update for Windows Server https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 will disrupt non-compliant Windows domain-members, and log event 5827 on the DC as the DC will refuse the secure-channel connection.

The KBarticle has been updated several times, and the body (step 1 and 2) and the FAQ section highlights this

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc