AD domain controller allowing vulnerable Netlogon secure channel connections

This vulnerability grants an unauthenticated attacker access to modify Active Directory passwords and elevate privileges, but does not directly grant administrative control. The attacker can use this access to gain unauthorized access to sensitive data and systems within the domain.

An attacker can exploit the Zerologon vulnerability to change Active Directory passwords, escalate privileges, and gain unauthorized access to sensitive data and systems within the domain. This allows the attacker to maintain persistence and potentially launch further attacks.

Cayosoft Guardian continuously monitors the Netlogon service for signs of the Zerologon vulnerability, flagging vulnerable connections as security issues so administrators can take corrective action.

Cayosoft Guardian alerts administrators to remove groups and accounts from the Allow list in Group Policy, preventing vulnerable Netlogon secure channel connections. This limits the attacker's ability to exploit the Zerologon vulnerability and maintain persistence.