Knowledgebase: You experience Warnings with EventID 5829 on Domain Controllers

Windows Server

In Microsoft-oriented networking infrastructures, your Active Directory Domain Controllers may suddenly experience high number of Warning events in the System log in Event Viewer (eventvwr.exe) with EventID 5829.

 

The cause

Microsoft has added this event by design to warn Active Directory administrators of vulnerable Netlogon connections, in terms of CVE-2020-1472. The eventID was added with the August 11, 2020 cumulative update, rollup update and security-only updates for all supported versions of Windows Server.

 

About CVE-2020-1472

A critical elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to an Active Directory Domain Controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a Domain Controller to obtain domain administrator access.

The vulnerability applies to all supported versions of Windows Server:

  1. Windows Server 2008 R2
  2. Windows Serer 2012
  3. Windows Server 2012 R2
  4. Windows Server 2016
  5. Windows Server 2019
  6. Windows Server, version 1903
  7. Windows Server, version 1909
  8. Windows Server, version 2004

Note:
Both Full Installations and Server Core installations of Windows Server are affected by CVE-2020-1472.

The vulnerability was responsibly disclosed to Microsoft by Tom Tervoort of Secura.

 

About EventID 5829

In the August 11th, 2020 cumulative update for Windows Server, Microsoft has added five new EventIDs to notify Active Directory administrators of vulnerable Netlogon connections:

  • EventID 5827 and EventID 5828
    These EventIDs signal denied Netlogon connections. These EventID trigger if vulnerable Netlogon connections are denied.
  • EventID 5829
    EventID 5829 triggers whenever a vulnerable Netlogon secure channel connection is allowed in the timeframe between applying the August 11th, 2020 cumulative update and applying the February 9th, 2021 cumulative update.
  • EventID 5830 and EventID 5831
    EventID 5830 and EventID 5831 are triggered when vulnerable Netlogon connections are allowed by the "Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy setting.

Microsoft is addressing the vulnerability in a phased two-part rollout. The August 11th, 2020 update and the February 9th, 2021 update address the CVE-2020-1472 vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.

 

How to solve events with EventID 5829

There are two ways to solve the events in the System Log with EventID 5829:

  1. Update the device, service and/or appliance that sets up the vulnerable Netlogon connection to support secure RPC with Netlogon secure channel. For Windows-based devices, this means updating them with the latest Windows Updates.
    Check to ensure that the Domain member: Digitally encrypt or sign secure channel data (always) Group Policy setting is set to Enabled.
  2. Use the "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy to add non-compliant accounts. This should only be considered a short-term remedy until non-compliant devices are addressed as described above.

Note:
The deadline for solving events with EventID 5829 is February 9th, 2021, as the February 9th, 2021 cumulative update will deny the vulnerable Netlogon connections associated with the Warnings with EventID 5829.

 

Further reading

CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability
How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472
[MS-NRPC]: Netlogon Remote Protocol 

12 Responses to Knowledgebase: You experience Warnings with EventID 5829 on Domain Controllers

  1.  

    So how do we fix the 5830 error, not just bypassing it with the GPO edit?

    This patch shut down my entire office this weekend when it was applied, and now I've got 22,000+ 5830 events logged since Sunday.

    • EventID 5830 indicates that you:

      • have the August 11th, 2020 cumulative update for Windows Server installed on your Domain Controllers;
      • have the "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy enabled with Domain Controllers in scope
      • have machine accounts for systems, services and/or applications connecting to the NetLogon shares that do not use secure RPC with Netlogon secure channels or do not support MS-NRPC

      Events with Event ID 5830 include the sAMAccountName of the machine initiating the insecure, but allowed, connection and information on the Operating System. To address the events with Event ID 5830, upgrade Windows- and Windows Server-based Operating Systems to versions that support Netlogon secure channel connections. For other Operating Systems, contact the device manufacturer (OEM) or software vendors to determine if their software is compatible with the latest Netlogon Remote Protocol (MS-NRPC).

      If you cannot remediate the connecting systems, but want to enforce the use of secure RPC with Netlogon secure channels on systems that support it, perform these actions to isolate the insecure systems (temporarily):

      • Create a new Active Directory site.
      • Deploy at least two Domain Controllers.
      • Provide the IP addresses of the two new Domain Controller and the IP addresses as /32 subnets to the new site.
      • Reboot the Domain Controllers so they appear as Domain Controllers for the site.
      • Manually point systems that do not support DCLocator to the new Domain Controllers and document the pre-existing configuation.
      • Create firewall rules to isolate the new Domain Controllers and the systems that do not support the feature. Make sure the systems that do not support the feature cannot access shares on the old Domain Controllers and that systems that support the feature cannot access shares on the new Domain Controllers. Additionally think about disabling lateral movement between the Domain Controllers themselves; Only allow the relevant network traffic.
      • Enable enforcement mode on the previously existing Domain Controllers and enable the "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy on the Domain Controllers only.
      • Monitor Event IDs 5827-5830 on the Domain Controllers towards the systems that support the feature and ignore Event ID 5827-5830 on the Domain Controllers towards the systems that do not support the feature.
      • Monitor firewall rules for networking traffic that attempts to break the isolation.

      Once the systems, services and/or applications connecting to the NetLogon shares that do not use secure RPC with Netlogon secure channels or do not support MS-NRPC have been remediated, delete their /32 subnet from Active Directory Sites and Services. These systems should flow back into the Active Directory site where they existed before. If they do not flow automatically, reboot them or manually point them to Domain Controllers that enforce secure connections (if they don't support DCLocator).

       
  2.  

    Hi
    I am a bit confused about the event IDs and the behavior explained in the initial deployment phase.
    Will all the insecure connections be denied and events 5827 and 5828 be raised.
    Or all of them will be allowed and only event 5829 will be raised.
    Isn't (5827, 5828) and (5829) mutually exclusive events ?

    • Hi Mittal,

      Indeed, Event IDs 5829 and 5827/5828 are mutually exclusive.
      The behavior of the Domain Controller depends on the "Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy setting.

       
  3.  

    Hi Sander,
    Why do we see these events 5827 and 5828 before Feb 2021? Are we good to ignore these events after the installation of August patch?

    I was asking this question since MSFT mentioned the remediation only needed for 5829.

    • Hi Lakshmi,

      You are seeing these events, because you've enforced the use secure channel connections ahead of the February 2021 automatic enforcement date.
      The events signal dropped connections in your current environment from devices that do not support secure channel connections.

      By default, supported versions of Windows that have been fully updated should not be causing these events. If the event is logged for a Windows device, then confirm that the device is running a supported versions of Windows and ensure the device is fully updated.
      For non-Windows devices, work with the device manufacturer (OEM) or software vendor to get support for secure RPC with Netlogon secure channel.

       
  4.  

    Thanks for Quick Response Sander.
    I presume you're referring to FullSecureChannelProtection Registry key, but this hasn't been modified after being introduced by August 11th Patch

    • Yes, the FullSecureChannelProtection registry key refers to the 'Domain controller: Allow vulnerable Netlogon secure channel connections' group policy setting. More info.
      It is enabled on your Domain Controllers. This causes the event ID to be triggered.

       
  5.  

    In case we see a Windows device with event ID 5827 and if we add that device to Active directory group that we create for excluding the devices that are making vulnerable connection. Will that let the windows device make the connection without any issue.

    OR is the Active directory group to define exclusion machines concept is solely for non windows devices?

    • Hi Manideep,

      The ability to connect to Domain Controllers is governed by the "Domain controller: Allow vulnerable Netlogon secure channel connections" group policy setting on Domain Controllers.
      If this setting is enabled, then any device can make non-secure connections. If this setting is disabled (as it will be per February), then no devices are allowed to make non-secure connections.
      The Group Policy setting does not allow you to create exceptions.

      If you need exceptions, you'll need to create an additional Active Directory site.
      If shared my instructions in one of my earlier comments.

       
  6.  

    Thanks for the swift response. We have applied the patch to all our domain controllers and we see 5827 events being generated from the machines in our domain.

    Now, these are windows machines and all of these are at same patch and OS level. Yet, some machines are generating the 5827 events and some are not.

    Now, i'm not sure if the machines which didn't generate the 5827 event yet are as well having issue and just that they did not generate the event yet.

    Is there any way that i can test connection from my clients to the domain controllers. Like if i do a ping test from the machine to Domain controller and if the machine has issue is the ping test supposed to generate 5827 event?

    Why I'm asking this is, we have a plan to enforce on domain controllers but before that we want to make sure that we add all the exception machines to the AD group. So, how do i get that list of machines which all have issue. As per what i see, it looks like machines take some time to generate 5827 event. So, im just thinking if there is any way that we can force test all the machines

leave your comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.