"Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy

Question

I am trying to create a GPO to address the netlogon secure channel vulnerability, so that certain things won't be impacted in February. However, the instructions contained in the article "https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc" aren't working for me. I log onto my 2016 DC and open up Group Policy management. When I go to create the new GPO, per the instructions, I do not have Computer Configuration\Windows Settings\Security Settings\Security Options. Instead, I have Computer Configuration\Policies\Windows Settings\Security Settings

Answer 1

Check my earlier reply. From cmd.exe run gpedit.msc then navigate to;

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Any advice how to find the missing setting!?
I don't see this setting too. Its just missing -see attached screenshot

Where you guys have 5 options starting with "Domain controller:..." I see 4, this option is MIA :/

PS: The server in question is 2012R2 - could this be the reason?

Answer 3

From cmd.exe run gpedit.msc then navigate to;

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Hi,

Based on my understanding, you have already install the updates for your 2016 DC server,right?

download address: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4571694

When complete the updates, restart the DCs .
Under the Computer Configuration > Windows Setting > Security Settings > Local Policy > Security Options,you can find the policy.

Answer 5

Hello, the update has been applied to all 2016 servers, including Domain Controllers. However, MS then says to configure the "Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy. They say this is done using GPMC and going to Computer Configuration > Windows Settings > Security Settings > Security Options. It isn't there. The path appears to be Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Sorry for not responding sooner but I am not getting email notifications when people reply to my posts. My settings are configured to get them.