How do you detect Zerologon (CVE-2020-1472) in Windows infrastructure?

Detect Zerologon by patching every domain controller, then watching the Netlogon secure channel events Microsoft added in the August 2020 updates. Events that report vulnerable connections show which devices still use insecure Netlogon. Fix or exception those devices, and confirm enforcement mode is active.

What is Zerologon?

CVE-2020-1472 is an elevation of privilege flaw in the Netlogon Remote Protocol (MS-NRPC), the RPC interface that domain joined devices use to authenticate and establish a secure channel with a domain controller. A successful attack could let someone with network access to a domain controller establish a vulnerable secure channel and gain domain administrator level control. The U.S. National Vulnerability Database lists the record, and CVE-2020-1472 appears in CISA's Known Exploited Vulnerabilities catalog.

What did Microsoft change, and in what phases?

Microsoft's guidance describes a phased fix. The initial deployment phase began with the updates of August 11, 2020. Those updates enforce secure RPC for machine accounts on Windows devices, for trust accounts and for all domain controllers. They also log new events to help you find non-compliant devices and add a group policy to allow named exceptions.

The enforcement phase began with updates released on or after February 9, 2021. Microsoft states that from then on, enforcement mode is enabled on all domain controllers and blocks vulnerable connections from non-compliant devices, and it cannot be disabled.

Microsoft lists four steps: update domain controllers, find devices making vulnerable connections by monitoring event logs, address those devices, and enable enforcement mode.

What should you look for in the logs?

The August 2020 update added Netlogon events on domain controllers in the System log. Microsoft's article lists them in its event log section. The pattern to remember:

• Events that report a connection was allowed because of a group policy exception.
• Events that report a vulnerable connection was denied.
• Events that report a vulnerable connection from a device that is not covered by an exception, which would be denied once enforcement is on.

Read the exact event IDs and text from Microsoft's article for your Windows Server version rather than from a blog summary, since they matter for your alert rules. Forward domain controller System logs to your central log store, and write a rule that alerts on any of these events.

Also check for the exposure itself. Registry value FullSecureChannelProtection controls enforcement mode on updated domain controllers, and the group policy named "Domain controller: Allow vulnerable Netlogon secure channel connections" controls exceptions. Any allowed account in that policy deserves an owner and a removal date.

What does an attack leave behind?

An attacker who abuses the flaw is changing the machine account password of a domain controller, which can later break domain controller replication or services. Unexpected account password changes, a domain controller account that suddenly cannot authenticate, and new use of replication privileges from a non domain controller host are all worth review. MITRE ATT&CK tracks the broader behaviour under exploitation of remote services and exploitation for privilege escalation.

Treat this as hunting guidance, not a guarantee. Absence of events does not prove absence of past abuse in an unpatched environment, so patch first, then investigate.

A constructed example

A company has 12 domain controllers. After the update, the log shows weekly events from a network storage appliance that uses an old authentication method. The owner finds the appliance vendor shipped a firmware fix. Until it is applied, the team adds a documented exception for that one account with a review date. Once the firmware is updated, they remove the exception and confirm that no more events appear for a full month, including month end jobs.

How to check or apply this

1. Confirm every domain controller, including read-only ones, has the August 2020 or later update.
2. Check that enforcement mode is active on each one.
3. Search System logs for the Netlogon secure channel events from the Microsoft article.
4. Create an inventory of devices and accounts behind each event.
5. Fix them, or add dated exceptions in the group policy with an owner.
6. Remove exceptions when the device is updated or retired.
7. Alert on any new allowed or denied vulnerable connection.
8. If a domain controller was ever unpatched and reachable by untrusted hosts, run a compromise assessment.

Quick check

Sources

• NVD: CVE-2020-1472
• Microsoft Security Response Center: CVE-2020-1472
• Microsoft Support: Manage the changes in Netlogon secure channel connections
• CISA Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK T1210: Exploitation of Remote Services

Last reviewed: 18 October 2026.