"Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy

Question

I am trying to create a GPO to address the netlogon secure channel vulnerability, so that certain things won't be impacted in February. However, the instructions contained in the article "https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc" aren't working for me. I log onto my 2016 DC and open up Group Policy management. When I go to create the new GPO, per the instructions, I do not have Computer Configuration\Windows Settings\Security Settings\Security Options. Instead, I have Computer Configuration\Policies\Windows Settings\Security Settings

Answer 1

Check my earlier reply. From cmd.exe run gpedit.msc then navigate to;

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

FYI,

I found that I only see the option when I RDP into one of the DC's and look with GPMC there. If I use an admin server with the tools installed and check remotely I do not see the setting.

Thanks,
JPB

Answer 3

Hi everyone,
In my case I updated my domain controller (Windows Server 2016) with 2020-08 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4571694). The same thing happens to me as several of you, it is installed and appears in the installed updates, but when I look in the group policy management console, I cannot find the option "Domain controller: Allow vulnerable Netlogon secure channel connections". I have already restarted the server but that setting still does not appear in the GPO, does anyone know what this depends on in order to have the option to add exceptions while identifying vulnerable cases when they arise?

Best regards,
Daniel.

Answer 4

is it possible that another domain controller overwrite the sysvol folder of my patched domain controller during sysvol frs synchronization/replication ?
and it overwrites with older admx files ?
thanks

Answer 5

POSSIBLE BUG: On Server 2012 R2, When the Policy "Domain controller: Allow vulnerable Netlogon secure channel connections" is set to NOT DEFINED, this registry key STILL contains old PREVIOUSLY set entries (security descriptors) in the list!!!!
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
"vulnerablechannelallowlist"