Zerologon

Zerologon is a critical vulnerability in the Netlogon Remote Protocol that can let an attacker impersonate a domain controller and take over an Active Directory domain. It works by bypassing cryptographic checks, which can allow password resets on the DC computer account without valid authentication.

Expanded Definition

Zerologon is the name commonly used for CVE-2020-1472, a severe flaw in the Netlogon Remote Protocol that can let an attacker spoof a domain controller and assume control of an Active Directory domain. In NHI and IAM discussions, it matters because the affected trust path governs machine-to-machine authentication, not human login workflows. The issue is not a weak password or stolen token; it is a protocol-level failure in how cryptographic checks were implemented.

Definitions are not controversial here, but usage in the industry is still sometimes imprecise because people say “Zerologon attack” when they really mean “domain controller compromise through Netlogon.” The distinction matters for incident scoping, patch validation, and recovery planning. NIST guidance on cyber risk management helps frame this as an identity integrity and trust-assurance problem, not only a vulnerability management event, as reflected in the NIST Cybersecurity Framework 2.0.

The most common misapplication is treating Zerologon as a generic Windows exploit, which occurs when defenders fail to recognise that the impact centres on domain trust and machine account authentication.

Examples and Use Cases

Implementing response controls for Zerologon rigorously often introduces operational friction, because protecting domain controllers can require aggressive hardening, staged reboots, and carefully timed patch windows that compete with availability goals.

• A security team detects suspicious Netlogon activity against a domain controller and uses patch verification plus event review to determine whether the environment is vulnerable.
• An enterprise applies Microsoft’s remediation steps, then validates that DCs no longer accept insecure Netlogon connections from unauthorised machines.
• During post-incident analysis, responders trace privilege escalation from a single compromised server to full domain compromise, confirming that the attack path exploited the trust boundary around the DC computer account.
• A red team reproduces the issue in a lab to test whether segmentation, administrative tiering, and monitoring around domain controllers can stop lateral movement.
• Governance teams map machine-account protection practices to the broader identity lifecycle guidance in the Ultimate Guide to NHIs, then align those controls with the NIST Cybersecurity Framework 2.0.

Why It Matters in NHI Security

Zerologon is a reminder that NHI security is not limited to secrets in vaults or API keys in pipelines. It also includes machine trust anchors, service authentication paths, and the integrity of systems that silently grant access at scale. When the protocol that authenticates a domain controller can be subverted, the result is not just a local breach. It is often complete compromise of the identity fabric that underpins users, servers, and services.

This is where the NHI statistics become operationally relevant: NHI Mgmt Group reports that Only 5.7% of organisations have full visibility into their service accounts, which means many environments cannot reliably prove whether adjacent machine identities were touched during a Zerologon incident. That lack of visibility turns recovery into forensics, and forensics into governance failure. Practitioners should treat domain controller trust paths as high-value NHI assets and verify hardening, monitoring, and response playbooks before exposure occurs. Organisations typically encounter the full consequence only after a domain takeover or emergency reset, at which point Zerologon becomes operationally unavoidable to address.