← Knowledge Center
Advisory CVE-2020-1472

Zerologon: domain takeover through a flaw in Netlogon's cryptography

CVE-2020-1472 (“Zerologon”) is an elevation-of-privilege vulnerability in the Netlogon Remote Protocol (MS-NRPC). A flaw in how the protocol applied AES-CFB8 encryption allowed an unauthenticated attacker with a network path to a domain controller to impersonate any machine — including the DC itself — and reset its Active Directory machine-account password to an empty value, yielding full domain compromise.

Why it matters for identity teams. Active Directory is the root of trust for most enterprise networks. A single unpatched DC reachable on the network was enough to take over every account in the domain. It became one of the most-exploited vulnerabilities of its era and prompted a U.S. CISA emergency directive.

What to take away:

  • Apply the Netlogon enforcement updates and move DCs to enforcement mode.
  • Restrict network reachability of domain controllers.
  • Continuously verify that AD account and machine-credential state matches policy — drift is exactly the kind of signal that flags abuse early.

This is a seed entry illustrating the Knowledge Center format. Read the full advisory at the primary source linked above, and CISA’s Known Exploited Vulnerabilities catalog.

Primary source

Microsoft Security Response Center

Read at msrc.microsoft.com ↗

Summary by AD Argus. We publish our own analysis with attribution and a link to the original report; always consult the primary source for authoritative detail.