CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability

CVE-2020-1472 is a privilege escalation vulnerability in Microsoft’s Netlogon Remote Protocol (MS-NRPC), also known as Zerologon. It allows an attacker who can reach a domain controller over the network to establish a vulnerable Netlogon secure channel connection and potentially elevate privileges. Successful exploitation can let an attacker run a specially crafted application on a device on the network, which in Active Directory environments can lead to full domain compromise. The weakness has been associated with ransomware activity, so organizations that still run unpatched domain controllers should treat this as a high-priority risk and confirm current status against the vendor advisory.

How it works

The underlying weakness is classified as CWE-330 (use of insufficiently random values). In the Netlogon authentication flow used to set up a secure channel between a machine and a domain controller, the protocol’s handling of cryptographic material was insufficiently robust. An attacker on the network can abuse that weakness when establishing a Netlogon secure channel connection to a domain controller. Once the channel is established in a vulnerable way, the attacker can escalate privileges and run attacker-controlled code in the context gained on the domain controller or related systems. Public detail on exact exploit mechanics should be taken only from the vendor advisory; defenders should assume that network-adjacent access to domain controllers is enough to attempt abuse of this class of flaw.

Am I affected? How to find it in your systems

This issue affects Microsoft Netlogon as used by domain controllers. Typical locations are Windows Server systems acting as Active Directory domain controllers that expose Netlogon (MS-NRPC) services to other machines on the network.

• Inventory all domain controllers and any systems that participate in Netlogon secure channel establishment. Use Active Directory tools, configuration management databases, and network service discovery to list DCs and confirm Netlogon-related endpoints.
• Check installed updates and build levels against the Microsoft advisory for CVE-2020-1472. Do not rely on version guesses; confirm the exact KBs or cumulative updates named by the vendor for your OS SKUs.
• Review whether legacy or less-secure Netlogon configurations remain enabled; the advisory describes which settings and enforcement modes matter after patching.
• For signs of exploitation, examine domain controller security and system logs for unusual Netlogon secure channel activity, unexpected machine account password changes, sudden privilege or replication anomalies, and authentication events that do not match normal DC-to-member patterns. Correlate with network telemetry showing unexpected clients speaking MS-NRPC to DCs. Treat any confirmed abuse as a potential domain-wide incident.

How to remediate

Patch first. Apply the updates Microsoft released for this vulnerability exactly as described in the vendor advisory and per CISA’s required action to apply updates per vendor instructions. After installing the updates on all domain controllers, follow Microsoft’s guidance on enabling full enforcement of secure Netlogon channel behavior so that vulnerable connection patterns are rejected. Validate that every DC has the fix and that enforcement mode matches the advisory’s recommended end state. Re-inventory and re-scan afterward to confirm no unpatched DCs remain. Hardening for this class also includes restricting which hosts can initiate Netlogon traffic to DCs, removing unnecessary exposure of domain controller protocols, and ensuring monitoring covers secure-channel and machine-account events.

If you can't patch immediately

If you cannot complete patching at once, reduce exposure until you can:

• Segment domain controllers so only authorized management and member systems can reach Netlogon/MS-NRPC ports; block or tightly control access from user subnets, guest networks, and the internet.
• Disable or restrict legacy Netlogon behaviors if the vendor guidance allows interim configuration changes that reject weak secure-channel establishment without breaking required production flows; test carefully.
• Use network-level controls or virtual patching where available to detect or block known abuse patterns of this protocol weakness, while understanding these are temporary and not a substitute for the official update.
• Increase monitoring and alerting on DC Netlogon events, machine account password resets, and anomalous privilege use; prepare an incident response path that assumes possible domain compromise if exploitation is suspected.
• Prioritize patching of internet-facing or poorly segmented DCs first, then complete the full rollout and enforcement steps from the advisory.

If your data may have been exposed

Actively exploited privilege-escalation flaws on domain controllers are frequently used in ransomware and broader intrusion campaigns. If you have unpatched DCs or see indicators of abuse, assume an attacker may have obtained elevated Active Directory access and follow your incident response process, including credential resets, scope assessment, and recovery from known-good state. As an additional check for personal or organizational email addresses that may appear in known breach datasets, you can run a free exposure scan to see whether those identities have shown up in published breach collections and then take appropriate account-hardening steps.