Zerologon let an unauthenticated attacker on the network seize a domain

What happened

Microsoft's own vulnerability record for CVE-2020-1472, published 17 August 2020, describes an elevation-of-privilege flaw in the Netlogon Remote Protocol: an unauthenticated attacker who could reach a domain controller over the network could exploit weak cryptography in the Netlogon secure-channel handshake to obtain domain administrator access, later nicknamed Zerologon. Microsoft addressed the flaw with a phased two-part rollout, issuing an initial fix in the August 2020 security updates and a second, enforcement-mode update planned for the first quarter of 2021 that would require every domain controller to reject the insecure connections the first patch had only flagged. Because an unpatched, reachable domain controller represented a near-total compromise of an organisation's identity infrastructure, the Cybersecurity and Infrastructure Security Agency treated it as urgent: its emergency directive, issued 18 September 2020, ordered federal civilian agencies to apply the August update to every Windows domain controller by 21 September 2020, or remove the device from the network, and to ensure any newly built domain controller was patched before it was connected at all.

Confidence and limits

Microsoft's own advisory and CISA's directive independently establish the vulnerability's mechanism, its publication date and the staged rollout; both are the primary technical and policy record for this vulnerability. A widely cited independent technical analysis of the underlying cryptographic weakness was not retrievable when checked, so this account relies on the vendor and government descriptions of the flaw's effect rather than an outside researcher's account of the mathematics behind it.

Why it mattered

A domain controller is the trust anchor for an entire Windows network; an unauthenticated attacker who could reach one over the network and take it over could then act as any user, including a domain administrator. The flaw's severity and CISA's compressed compliance deadline reflected that a single missed patch on a single domain controller could undo every other identity control an organisation had in place.

Defensive takeaway

Verify not only that the August 2020 update is installed on every domain controller, but that the later enforcement-mode update was also applied and enabled, since a domain controller left in compatibility mode after the first patch could still accept an insecure connection from a legacy or misconfigured device.

• Can we confirm, per domain controller, that both phases of the Zerologon fix are installed and enforced, not just the first?
• Would a newly provisioned domain controller in our environment ever be exposed to the network before it is fully patched?
• Do we monitor for Netlogon authentication attempts that would be rejected once full enforcement is enabled?

Zerologon is now years old and comprehensively patched where organisations have kept current, but it remains a standard test case for why domain controllers, more than most other servers, need patch verification rather than patch deployment alone: a missed enforcement step can leave the underlying weakness intact even after the update is technically installed.