Zerologon Netlogon CVE-2020-1472 (unauthenticated domain controller takeover via MS-NRPC, CISA KEV): how do I enforce the fix and find devices that still break?

What it is: CVE-2020-1472 (Zerologon) is an elevation-of-privilege flaw in the Netlogon Remote Protocol secure channel. An unauthenticated attacker with network access to a domain controller can establish a vulnerable secure channel and obtain domain administrator access. Microsoft fixed it in two phases starting with the August 11, 2020 updates, and enforcement began with the February 9, 2021 updates. It is in CISA's KEV catalog, with ransomware use noted. Any domain controller (including read-only DCs) missing the updates is at risk. Am I affected: - Windows Server 2008 R2 through 2019 and the semi-annual releases listed in NVD, when acting as domain controllers without the August 2020+ updates. Samba (before 4.10.18, 4.11.13, 4.12.7) and some Linux-based directory products are also listed in NVD. - Check each DC's patch level and look for Netlogon events 5827-5831 in the System log. Fix: 1. Install the August 11, 2020 or later cumulative update on every DC, including RODCs, and keep DCs current. The February 9, 2021 or later updates enforce secure RPC on all DCs regardless of the registry setting. 2. Use events to find non-compliant devices: 5829 (vulnerable connection allowed, initial phase only), 5827 and 5828 (connection denied for a machine or trust account), 5830 and 5831 (allowed by group-policy exception). 3. Bring those devices up to date: update Windows machines, get secure-RPC support from the vendor for non-Windows devices (including old NAS and Samba), or retire them. Only as a temporary measure, add specific accounts to the "Domain controller: Allow vulnerable Netlogon secure channel connections" policy, which keeps them exposed. 4. Before enforcement is built in you may set FullSecureChannelProtection to 1 under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters; it is not needed after the February 2021 updates. 5. If a DC was unpatched and reachable, hunt for unexpected domain-admin changes and replication or password-reset activity, reset the DC machine account and privileged credentials (including the krbtgt account, per Microsoft's AD recovery guidance). Verify: all DCs show the update installed and no 5827/5828 errors for needed devices remain. Sources: https://support.microsoft.com/en-us/topic/kb4557222-how-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73cd1a11e https://nvd.nist.gov/vuln/detail/CVE-2020-1472 https://www.cisa.gov/known-exploited-vulnerabilities-catalog