# CVE-2026-41089: How One Netlogon Packet Can Take Down Your Entire AD Source: https://ai.techclick.in/blog_netlogon_cve_2026_41089_dc_takedown Markdown: https://ai.techclick.in/blog_netlogon_cve_2026_41089_dc_takedown.md Publisher: Techclick Infosec Pvt Ltd CVE-2026-41089 is a CVSS 9.8 Netlogon RCE that gives an unauthenticated attacker SYSTEM on a Windows domain controller. Learn what Netlogon is, how one packet takes down AD, and how to detect + patch it before your DCs become someone else's playground. CVE-2026-41089: How One Netlogon Packet Can Take Down Your Entire AD student learning map A visual study map for CVE-2026-41089: How One Netlogon Packet Can Take Down Your Entire AD showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP CVE-2026-41089: How One Netlogon Packet Can Take... Microsoft · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start Pick where you want to start 2. Understand The TCS office ID-card panel — a... 3. Prove Why this matters — in 10 seconds... 4. Practice What Netlogon actually is — the... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Infographic: concept-to-practice path CVE-2026-41089: How One Netlogon Packet Can Take Down... Learn Pick where you want to start Map The TCS office ID-card panel — a... Operate Why this matters — in 10 seconds... Verify What Netlogon actually is — the... Read in this order so the topic becomes a working runbook, not isolated notes. Start with the mental model, then move into the workflow, evidence, and practice questions. Infographic: evidence ladder Do not answer from memory only - prove the stage Scope who, what, where, when Policy rule, condition, action Telemetry logs, event, metric Retest original symptom fixed Interview signal: every claim should map to observable evidence. Use this ladder when the question asks for troubleshooting, rollout, or proof. Infographic: healthy vs broken thinking Healthy answer vs broken answer Healthy Names the object, follows the flow, checks logs, and validates the result. Broken Lists features randomly, changes production first, or skips verification. Your goal: connect the concept to a realistic production decision. This comparison turns the article into an interview and troubleshooting checklist. Infographic: mini runbook Mini runbook for this topic Before baseline and scope During change one thing After monitor and rollback Use this page to prepare one practical story: problem, evidence, fix, verification. Convert the learning into a practical story you can explain to a manager or interviewer. ## Pick where you want to start 1 ### What Netlogon is The privileged RPC service that runs as SYSTEM on every DC. 2 ### The attack chain One unauthenticated packet → stack overflow → SYSTEM → domain. 3 ### Detect it Malformed NRPC + Netlogon crash, in Splunk and Sentinel. 4 ### Patch it safely The KB and FSMO order that won't break replication. ## The TCS office ID-card panel — a story you already know You work at the TCS Bengaluru office. Every morning when Sneha swipes her ID card on the entry panel, a silent conversation happens. The panel asks the central security system: "is this Sneha, is she still on payroll, what floors can she enter?" The central system answers in milliseconds. Sneha never sees the conversation. It just works — 50,000 times a day, across every door. Now imagine someone walks up to the panel itself, jams a thin metal pin into a specific slot, and the panel responds by handing them the master key to every door in the building . They did not pretend to be Sneha. They did not steal her card. They just exploited the panel's own firmware. That is CVE-2026-41089 . The panel is your domain controller . The silent conversation is Netlogon . The master key is full SYSTEM on every machine your AD touches. ## Why this matters — in 10 seconds and in a paycheck If you are sitting in an interview next week, this is the question. "A CVE dropped this month rated 9.8 against Windows DCs. Tell me what it does, how you would detect it, and what you would patch first." Get the answer wrong and the panel moves on. Get it right and you have separated yourself from every candidate who memorised buzzwords without learning the protocol underneath. Why does the security industry care so much? Because compromising a domain controller is compromising the domain itself . A DC holds the NTDS.dit credential database , the Kerberos signing key ( krbtgt ), and the trust relationships with every member server and workstation. One DC down = every server, every desktop, every laptop, every cloud-joined identity, every Exchange mailbox — all yours. ! Why "patch later" is the wrong answer When ZeroLogon (CVE-2020-1472) was published, public exploit code dropped within 48 hours and organisations that delayed patching for a quarterly maintenance window were hit by Conti, Ryuk, and several Indian-targeted ransomware crews. CVE-2026-41089 had functional exploit code circulating within hours of disclosure on 12 May 2026. The window between disclosure and weaponisation is no longer "weeks." It is one workday. ## What Netlogon actually is — the core concept Netlogon is the Windows Remote Procedure Call ( RPC ) service that handles three quiet jobs: - User logon authentication — when Rahul logs into his TCS laptop, his workstation does not talk to AD with his password. It hands the password to its Netlogon client, which runs an encrypted challenge-response over the MS-NRPC protocol against a DC. - Machine-account password rotation — every domain-joined PC has a machine account whose password rotates every 30 days. Netlogon is what rotates it. - DC-to-DC replication trust — when two DCs need to verify each other before replicating Active Directory data, they shake hands over Netlogon's secure channel. Critically, the Netlogon service runs inside lsass.exe on every DC, and lsass.exe runs as NT AUTHORITY\SYSTEM . That is the privilege the bug hands to the attacker. Not Administrator. SYSTEM. On the DC. 🔑 Lock in the key terms — tap to flip 📞 Netlogon tap to flip The Windows RPC service that runs every authentication conversation between a workstation and its DC. Runs as SYSTEM inside lsass.exe — which is exactly why CVE-2026-41089 is so dangerous. 📨 MS-NRPC tap to flip Microsoft Netlogon Remote Protocol — the wire format Netlogon speaks. The exploit sends a crafted MS-NRPC packet with an oversized argument to overflow the stack buffer. 💾 NTDS.dit tap to flip The file on every DC storing the password hash of every domain account — the crown jewels. SYSTEM on the DC means read access to it, so one DC compromise burns the whole domain. 🎫 krbtgt tap to flip The special account whose password signs every Kerberos ticket. Steal its hash and you can forge a Golden Ticket — unlimited, persistent access to the domain. Legend domain-joined clients / attacker (royal) the domain controller & its Netlogon service (cyan-magenta) the crown jewels — NTDS.dit / krbtgt (navy) healthy / patched exploited / dropped SVG 1 — Netlogon's position in an AD network Shows three workstations and an Exchange server talking to two domain controllers over the Netlogon RPC service. The Netlogon component on each DC is highlighted because it is the attack surface for CVE-2026-41089. - Sneha's laptop 10.42.10.55 Rahul's desktop 10.42.10.78 Exchange server 10.42.20.10 Domain-joined clients DC01 — Primary DC 10.42.50.10 · Windows Server 2022 Netlogon · lsass.exe · SYSTEM DC02 — Replica DC 10.42.50.11 · Windows Server 2025 Netlogon · lsass.exe · SYSTEM Active Directory forest: corp.tcs.local MS-NRPC over RPC Secure channel Every domain-joined device talks to a DC over MS-NRPC. The bug lives inside the Netlogon component on the DC — the same component that answers every authentication request. That is what makes the attack surface enormous. 👩‍💻 Scenario — Sneha at Infosys Pune Sneha is an L1 SOC analyst. Her CISO walks past her desk on 13 May 2026 and asks: "are our DCs running Netlogon?" The trick question — every DC has Netlogon running. There is no "off." It's how the AD service exists. The right answer is "yes, on every DC by design — that is exactly why CVE-2026-41089 is rated 9.8." ## How CVE-2026-41089 actually fires The bug is a stack-based buffer overflow in Netlogon's message-handling code. Netlogon writes attacker-controlled bytes into a fixed-size stack buffer without checking the length. Because the buffer sits on the stack, the overflow can overwrite the function's saved return address. The attacker chooses what that overwritten return address points to — typically into a small payload they embedded earlier in the same packet, or into a ROP chain made of existing Netlogon code gadgets. Either way, execution lands wherever the attacker chose, running as SYSTEM, inside the Netlogon service. What is unusual here is the pre-authentication property. The attacker does not need a domain user account. They do not need to be on the AD-joined LAN. They just need TCP/UDP reachability to the DC's RPC endpoint mapper on port 135 and the dynamic high port Netlogon negotiates afterwards. In a flat enterprise LAN — and most Indian enterprise networks are flatter than the architects admit — that means any compromised workstation can pivot to DC SYSTEM in one packet. SVG 2 — The five steps from packet to domain compromise Attacker workstation sends a crafted MS-NRPC packet to the domain controller. The packet overflows a stack buffer inside the Netlogon service, overwriting the saved return address. Execution lands in attacker-supplied shellcode, which runs as SYSTEM and then pulls the NTDS credential database. 1. Attacker 10.42.10.99 (compromised PC) 2. Crafted MS-NRPC oversized arg 3. Stack overflow return addr overwritten 4. SYSTEM shellcode inside lsass.exe 5. Dump NTDS.dit + krbtgt hash From one unauthenticated packet to full domain compromise Total time observed in lab repro: under 30 seconds Once step 5 completes, every account in the domain — including domain admins — is burned. Domain rebuild required. Steps 1-3 happen pre-authentication. By step 4 the attacker owns the DC itself. By step 5 they own the domain — and "rebuilding AD from scratch" is now on the table. ### ▶ Watch one packet take down the domain A compromised workstation ( 10.42.10.99 ) sends one crafted MS-NRPC packet at an unpatched DC. Press Play to walk the exploit chain, then Break it to see what stops it — the May 2026 patch. ① Request The attacker reaches the DC's RPC endpoint mapper on port 135 , looks up the dynamic high port Netlogon is listening on — no domain account needed . ▼ ② Trigger A crafted MS-NRPC message carries an oversized argument. Netlogon copies it into a fixed-size stack buffer without a length check — the saved return address is overwritten. ▼ ③ Execute Execution lands in the attacker's payload (or a ROP chain), running as NT AUTHORITY\SYSTEM inside lsass.exe on the DC — no Administrator login was ever needed. ▼ ④ DC compromise With SYSTEM on the DC, the attacker reads NTDS.dit (every account hash) and the krbtgt key — Golden Ticket material. The whole domain is now burned. ▼ ⑤ Detect / fix The SOC sees the tell-tale pattern: oversized MS-NRPC from one source + the Netlogon service crashing (Event 7034). Detection covers the gap — but only the binary patch truly closes it. Press Play to walk the exploit chain on an unpatched DC, then press Break it to apply the patch. ▶ Play Next ▶ 🛡 Break it (patch) ↺ Reset Quick check · The exploit chain In the chain above, why does code execution inside Netlogon mean full domain compromise — not just one server? a) Netlogon runs in the logged-on user's context, so it inherits that user's group memberships. b) Netlogon runs as SYSTEM inside lsass.exe — that process can read NTDS.dit (every hash) and the krbtgt key, so SYSTEM on the DC = the domain. c) The DC's firewall is disabled by default, exposing all SMB shares. d) Netlogon decrypts every Kerberos ticket on the wire. Correct: b. The privilege escalation is automatic — execution inside lsass.exe is SYSTEM, which can read the NTDS.dit credential store and the krbtgt password (Golden Ticket forging). Netlogon does not run as the user, and it does not decrypt Kerberos tickets. 👩‍💻 Scenario — Priya at Wipro Bengaluru Priya manages a 14-DC forest. She reads the advisory at 11 PM on 12 May, panics, and DMs her manager. The right next move is not "patch all 14 right now." It is "isolate the RPC endpoint mapper from untrusted segments, then patch in waves starting with internet-adjacent DCs." Order matters. Panic patching is how you break replication. ## How CVE-2026-41089 is different from ZeroLogon (and why both still matter) If you have done CISSP prep, you remember ZeroLogon (CVE-2020-1472). Both bugs end in "attacker owns the domain via Netlogon," but the root cause and the detection signal are very different. An interviewer will absolutely ask you to distinguish them. SVG 3 — Side-by-side: the three big Netlogon CVEs Three columns comparing root cause, authentication required, what an attacker gets, detection signal, and fix difficulty across the three biggest Netlogon vulnerabilities. CVE-2020-1472 · ZeroLogon CVE-2022-38023 · RPC sign CVE-2026-41089 · NEW ROOT CAUSE Crypto flaw — AES-CFB8 IV reuse allows zeroing the machine-account password. Insufficient RPC signing enforcement allows downgrade to unsigned channels. Stack buffer overflow in Netlogon message handler. Classic memory-safety bug. AUTH REQUIRED? None (LAN reachability only) Valid domain account None (LAN reachability only) ATTACKER GETS DC machine account = domain MITM on machine auth SYSTEM on DC = full domain DETECTION SIGNAL Event 5829 (vuln conn) Event 5840/5841 (downgrade) Event 5805 + Netlogon crash Same protocol, three different bug classes. CVE-2026-41089 is the most dangerous because, like ZeroLogon, it requires no authentication — but unlike ZeroLogon, the patch order also matters (more in the next section). 👨‍💻 Scenario — Karthik at Flipkart Bengaluru Karthik did Zerologon remediation in 2020. He asks his lead: "is this just ZeroLogon again?" The honest answer is no — ZeroLogon was a crypto bug fixable by enforcing secure-channel signing. CVE-2026-41089 is a memory-corruption bug; the only fix is the binary patch. There is no "policy workaround" this time. So far: Netlogon = AD's authentication chatbot, it runs as SYSTEM on every DC, and CVE-2026-41089 lets one unauthenticated packet hand SYSTEM to an attacker. Next we check whether your DCs are exposed. ## Hands-on — is your DC vulnerable? Three checks. Run them on each DC, in order. All commands run in an elevated PowerShell. ### Check 1 — is the May 2026 patch installed? PowerShell on the DC (elevated) Get-HotFix -Id KB5058411, KB5058385 | Select-Object HotFixID, InstalledOn, InstalledBy ✓ Expected output (patched DC) HotFixID InstalledOn InstalledBy -------- ----------- ----------- KB5058411 5/13/2026 NT AUTHORITY\SYSTEM KB5058385 5/13/2026 NT AUTHORITY\SYSTEM Empty output = the DC is unpatched . Move to step 2 immediately. ### Check 2 — what build are we on? PowerShell — confirm OS build is post-May-2026 Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, OsHardwareAbstractionLayer # Server 2022 fixed build: 20348.3517 or higher # Server 2025 fixed build: 26100.3915 or higher ### Check 3 — is Netlogon's RPC endpoint reachable from places it shouldn't be? From a workstation that should NOT reach the DC's RPC endpoint Test-NetConnection -ComputerName 10.42.50.10 -Port 135 # If TcpTestSucceeded = True from a user VLAN, your DC's RPC interface # is exposed to every workstation. That is the attack surface. ## Patch deployment — the order that does not break replication Snapshot every DC (VM checkpoint or backup) before any reboot. If anything goes sideways with the secure channel, you want a rollback point. - Patch the PDC Emulator FSMO holder LAST , not first. The PDC Emulator is the time source and password-change authority — if it goes down mid-patch, every other DC's clock skews and Kerberos breaks. - Patch in this order: replica DCs in the largest site first → replica DCs in branch sites → finally the PDC Emulator. One DC at a time per site. Wait for replication to converge ( repadmin /showrepl ) between each. - After each DC reboots, verify the secure channel still works: Test-ComputerSecureChannel -Verbose on a member server in the same site. Expected: True . - Re-test reachability + Get-HotFix from step 1. Quick check · Patch order In what order do you patch a multi-DC forest so you don't break Kerberos and replication? a) PDC Emulator first, since it's the most important DC. b) Replica DCs first (largest site → branch sites), then the PDC Emulator LAST — snapshot each, wait for replication to converge between reboots. c) Disable Netlogon org-wide, patch everything at once, re-enable. d) Install only the SSU — it pulls in the LCU automatically. Correct: b. The PDC Emulator is the time source and password-change authority — patch it last so its reboot doesn't skew every other DC's clock and break Kerberos. Snapshot first and let repadmin /showrepl converge between DCs. Disabling Netlogon breaks all auth, and the SSU does not include the LCU. 👨‍💻 Scenario — Rahul at TCS Bengaluru Rahul runs Get-HotFix on his 14 DCs and finds 6 of them still on the April 2026 baseline because the WSUS rule was set to "auto-approve Important only." May's Netlogon patch was tagged Critical and skipped. Fix the WSUS classification first, then push. Lesson — WSUS rules drift, audit them every Patch Tuesday. ## Detection — catching exploitation in Splunk + Microsoft Sentinel Patching is half the job. Until every DC is patched (and even after), you want a detection that fires on the pre-exploit pattern: malformed MS-NRPC packets + unexpected Netlogon service crashes . Enable enhanced Netlogon logging first. Enable Netlogon debug logging on the DC nltest /dbflag:0x2080FFFF # Logs to %WINDIR%\debug\netlogon.log # Look for Event IDs 5805, 5827, 5828, 5829, 5830, 5831 ### Splunk SPL — burst of malformed NRPC from a single source Splunk Enterprise Security index=wineventlog source="WinEventLog:System" (EventCode=5805 OR EventCode=5827 OR EventCode=5828 OR EventCode=5829 OR EventCode=5830 OR EventCode=5831) | bin _time span=5m | stats count by _time, host, src_ip | where count > 10 | sort - count ### Microsoft Sentinel KQL — Netlogon service crash followed by lsass access Sentinel Analytics Rule (KQL) let netlogonCrash = Event | where EventLog == "System" | where Source == "Service Control Manager" | where EventID == 7034 | where RenderedDescription contains "Netlogon" | project crashTime = TimeGenerated, Computer; let lsassRead = DeviceProcessEvents | where ProcessCommandLine has_any ("lsass", "comsvcs.dll", "MiniDump") | project readTime = TimeGenerated, Computer, AccountName, ProcessCommandLine; netlogonCrash | join kind=inner lsassRead on Computer | where readTime between (crashTime .. (crashTime + 10m)) | project crashTime, Computer, AccountName, ProcessCommandLine Quick check · Detection Your SOC alerts on every single Event ID 5805. After a week the analysts are drowning in noise. What is the higher-fidelity rule? a) Alert on any Netlogon service restart, even manual admin restarts. b) Alert only when DC CPU exceeds 90% — exploitation always spikes CPU. c) Correlate a burst of malformed-NRPC events (5805/5827-5831) from one src_ip with a real Netlogon crash (Event 7034) within minutes. d) Turn off Event 5805 logging so the noise stops. Correct: c. Event 5805 fires on benign clock skew too, so alone it is necessary but not sufficient. Correlating the pre-exploit pattern (malformed RPC from one source) with the post-exploit signal (the Netlogon service crashing) is what turns an alert flood into a real detection. ! Common mistakes - "We have a firewall, we're fine." — North-south firewalls do not stop east-west pivoting. The attacker only needs one compromised workstation on your LAN. Segmenting DCs into their own VLAN with strict ACLs to port 135 + RPC range is the real control. - Patching PDC Emulator first. — Breaks Kerberos for the duration of the reboot. Always last. - Disabling Netlogon as a "workaround." — Disables every authentication in the domain. Do not do this. There is no policy mitigation; only the patch. - Trusting Event 5805 alone. — It also fires on benign clock-skew issues. Correlate with a Netlogon service crash (Event 7034 from Service Control Manager) for high-fidelity detection. - Forgetting the read-only DCs (RODCs). — They also run Netlogon. They are also vulnerable. Audit your Get-ADDomainController -Filter * output, not just your "main" DCs. ★ Pro tips - Add the May 2026 cumulative update KBs to your WSUS auto-approve rule for Critical + Security Updates so future Netlogon-class bugs land automatically on DCs at the next maintenance window. - Run Set-ADObject -Identity (Get-ADDomain).DistinguishedName -Replace @{"msDS-Behavior-Version"=7} to confirm the domain functional level is current — older levels sometimes block newer patches from applying cleanly. - For SOC: pre-write the Sentinel/Splunk rules above today even if you are patched. Detection-as-code beats panic-after-the-fact every time. 👨‍💻 Scenario — Aditya at HCL Lucknow Aditya patches DC03 and sees Event ID 5719 ("This computer was not able to set up a secure session") flood the log for 6 minutes. Trainee instinct says rollback. Senior move: wait 10 minutes for the secure channel to rebuild, then run Test-ComputerSecureChannel -Repair from a member server. Patching transient errors are normal; permanent ones aren't. ### 📋 Quick reference — CVE-2026-41089 cheat sheet Field Value CVE CVE-2026-41089 CVSS v3.1 9.8 Critical (AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H) Bug class Stack-based buffer overflow in MS-NRPC message handler Auth required None — pre-authentication RCE Affected Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025 (DC role + RPC interface exposed) Patches KB5058411 (Server 2022), KB5058385 (Server 2025); equivalent KBs for older releases Detection events System log Event IDs 5805, 5827-5831; Service Control Manager Event 7034 (Netlogon crash) Patch order Replica DCs first → branch DCs → PDC Emulator LAST No workaround Only the binary patch fixes it. No policy/registry mitigation works. ## Glossary - Active Directory (AD) — Microsoft's directory service that holds user accounts, computer accounts, and group policies for a Windows network. - Domain Controller (DC) — a server running AD Domain Services that authenticates users and computers in the domain. - Netlogon — the Windows RPC service that runs all authentication conversations between a workstation and its DC. Runs as SYSTEM inside lsass.exe . - MS-NRPC — Microsoft Netlogon Remote Protocol. The wire format Netlogon uses. - RPC — Remote Procedure Call. A way for one Windows machine to invoke a function on another. - NTDS.dit — the file on a DC that stores every domain user's password hash. The crown jewels. - krbtgt — the special account whose password signs every Kerberos ticket. Theft = Golden Ticket attack = unlimited persistence. - PDC Emulator — the FSMO role-holder DC that is the master time source and password-change authority for the domain. - RODC — Read-Only Domain Controller. Used in branch sites. Still runs Netlogon, still vulnerable. - CVSS — Common Vulnerability Scoring System. 9.0-10.0 = Critical. ## Sources used in this lesson - NVD — CVE-2026-41089 official detail - Microsoft Learn — MS-NRPC Netlogon Remote Protocol spec - The Hacker News — May 2026 patches including Netlogon RCE - Tenable — May 2026 Patch Tuesday analysis - CrowdStrike — May 2026 Patch Tuesday telemetry - Rapid7 — Patch Tuesday May 2026 deep dive - The Hacker Recipes — ZeroLogon (CVE-2020-1472) historical context - CERT/CC VU#490028 — Netlogon AES-CFB8 cryptographic issue ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. The exact framing an interviewer wants to hear. In one sentence, what is CVE-2026-41089? Why does compromising Netlogon mean compromising the whole domain? How is this different from ZeroLogon? Which KBs do I install and in what order? How do I detect exploitation in Splunk or Sentinel? Is there a workaround if I can't patch immediately? Pre-curated from this lesson + the NVD/MSRC advisory, scoped to CVE-2026-41089. For a live incident, escalate through your SOC runbook. ## 📝 Check your understanding — 10 scenario questions Bloom-tiered mix: 1 recall, 3 apply, 4 analyze, 2 evaluate. Pick one answer per question. You need 70% (7 of 10) to mark this lesson complete on your profile. Q1 Remember What CVSS v3.1 base score does CVE-2026-41089 carry? 7.5 8.8 9.8 10.0 Correct: c. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 10.0 would require a "scope changed" component which this bug does not have because the impact stays within the affected component. 7.5 and 8.8 would imply some form of user interaction or authentication requirement, both of which are absent. Q2 Apply Sneha at Infosys has to patch a Windows Server 2022 DC for CVE-2026-41089. Which Microsoft KB should she install? KB5005565 (Server 2019 baseline) KB5058411 KB5034441 (April 2026 rollup) Any May 2026 SSU — the SSU includes the LCU automatically Correct: b. KB5058411 is the May 2026 Server 2022 cumulative update that contains the Netlogon fix. (a) is for a different Server version. (c) is from April and predates the disclosure. (d) is a common misconception — the SSU (Servicing Stack Update) does NOT include the LCU; both must be deployed. Q3 Apply Priya at Wipro is mid-patch. After KB5058411 installs, DC03 reboots but the Netlogon secure channel to a member server breaks. What is her correct next step? Wait ~10 minutes and run Test-ComputerSecureChannel -Repair from the member server Uninstall KB5058411 immediately to restore the channel Demote DC03, re-promote it, and re-replicate Disable Netlogon enforcement via FullSecureChannelProtection=0 Correct: a. Transient secure-channel errors after a DC reboot are normal — the channel rebuilds in minutes. (b) is the panic move that re-exposes you to the CVE. (c) is wildly over-reactive. (d) disables the very protection the patch enables and reopens the org to ZeroLogon-class attacks. Q4 Apply Karthik at Flipkart wants a one-line check across 14 DCs to confirm the Netlogon patch is installed. Best command? Get-Service Netlogon on each DC nltest /sc_query:CORP Get-EventLog System -Newest 50 | ? Source -eq Netlogon Invoke-Command -ComputerName (Get-ADDomainController -Filter *).Name { Get-HotFix -Id KB5058411 } Correct: d. Fan-out over WinRM with Get-HotFix filtered to the specific KB is the right tool. (a) only tells you the service runs — every DC's service runs by definition. (b) checks secure-channel health, not patch status. (c) shows recent log entries but does not prove the patch is installed. Q5 Analyze Rahul's SOC sees the Netlogon service on DC02 crash and auto-restart three times in 8 minutes. tcpdump on DC02's interface shows oversized MS-NRPC requests from 10.42.10.99. Most likely diagnosis? DC02 has a failing hard disk causing service hangs A workstation has a misconfigured NIC sending malformed packets Active exploitation attempt of CVE-2026-41089 from 10.42.10.99 Routine Kerberos ticket renewal noise Correct: c. Repeated Netlogon crashes correlated with oversized inbound MS-NRPC packets from a single source = textbook exploit attempt. (a) and (b) would not produce the specific oversized-RPC pattern. (d) Kerberos uses port 88, not Netlogon RPC, and does not cause the service to crash. Action: isolate 10.42.10.99, snapshot DC02, hunt for SYSTEM-level child processes spawned by lsass.exe. Q6 Analyze Aditya at HCL Lucknow sees Event ID 5805 firing on DC04 every 30 seconds for two days. No service crash. No oversized packets. Most likely cause? Slow-burn exploitation of CVE-2026-41089 — isolate immediately Benign clock skew or stale machine-account password on a member server DC04 has been compromised — assume Golden Ticket and burn krbtgt twice A worm scanning the network for SMB shares Correct: b. Event 5805 alone, without correlated crashes or oversized RPC, is most commonly clock skew or a stuck machine-account password. This is exactly the false-positive trap mentioned in Common Mistakes — Event 5805 is necessary but not sufficient. Correlate with Event 7034 (Service Control Manager — Netlogon crash) before going to (a) or (c). Q7 Analyze How does CVE-2026-41089 fundamentally differ from CVE-2020-1472 (ZeroLogon)? 41089 requires a domain-joined attacker; ZeroLogon did not 41089 is a memory-corruption RCE; ZeroLogon was a crypto flaw fixable by enforcing secure-channel signing 41089 only affects Windows Server 2025; ZeroLogon affected all versions 41089 needs physical access to the DC; ZeroLogon was network-exploitable Correct: b. The bug classes are different: ZeroLogon abused an AES-CFB8 initialization vector reuse to zero out the DC's machine-account password — fixable via the FullSecureChannelProtection registry enforcement. 41089 is a stack buffer overflow; only the binary patch fixes it. There is no policy workaround. (a), (c), and (d) are all factually wrong. Q8 Analyze Why does Netlogon's compromise translate to full domain compromise? Netlogon runs in user context, so it can pivot through user mailboxes Because the DC's firewall is disabled by default and exposes SMB shares Netlogon proxies all Kerberos traffic and decrypts it on the wire Netlogon runs as SYSTEM inside lsass.exe — that process holds the NTDS credential store and the krbtgt key material; reading lsass = domain takeover Correct: d. The privilege escalation is automatic: code execution inside lsass.exe = SYSTEM = read access to NTDS.dit (every account hash) and the krbtgt password (Golden Ticket forging). (a) is wrong — Netlogon runs as SYSTEM, not user. (b) is unrelated. (c) is a misconception; Netlogon does not decrypt Kerberos tickets. Q9 Evaluate A 5,000-user Indian SI firm has 24 DCs across 6 sites. The CISO asks: "should we deploy detection rules first and then patch, or patch first and then detect?" What is the right call? Detection first — patching during business hours risks outages, detection has zero risk Patch DCs first (in correct FSMO order) — detection rules are valuable but cannot stop an in-flight exploit; the binary patch is the only true mitigation. Stand up detection rules in parallel for any unpatched window. Neither — disable Netlogon org-wide until the next quarterly window Wait for CrowdStrike/SentinelOne to release an EDR signature, then patch only DCs flagged by the EDR Correct: b. Detection is necessary but not sufficient — by the time the rule fires, the attacker is already SYSTEM. Patch is the only true preventive. Run both tracks in parallel: emergency-patch the DCs in correct FSMO order over the next 24 hours while detection rules cover the gap. (a) accepts unacceptable risk on critical infrastructure. (c) breaks the entire domain. (d) is reactive theater. Q10 Evaluate You are designing a high-fidelity detection rule for CVE-2026-41089 in Splunk. Which event-correlation logic is the strongest signal? Alert on every single Event ID 5805 occurrence Alert when the Netlogon service is restarted manually by an admin Alert on bursts of Event 5805 + 5827-5831 from a single src_ip within 5 minutes, AND a correlated Event 7034 "Netlogon service crashed" within 10 minutes Alert when DC CPU exceeds 90% — exploitation always spikes CPU Correct: c. High-fidelity detection requires correlation of the pre-exploit pattern (malformed RPC events from one source) with the post-exploit signal (the Netlogon service actually crashing). (a) drowns the SOC in 5805 false positives from clock skew. (b) is normal admin behavior. (d) is false — modern exploits often complete in milliseconds with no CPU spike. Correlation across the kill chain is the difference between an L1 alert flood and an L2-grade rule. Submit answers Try again Lesson complete — saved to your profile. Almost! Review the Detection + Patch sections above and try again — you need 70% (7 of 10) to mark this lesson complete. ### What's next? Now that you can defend a DC, learn how to attack one (ethically) — CISSP Domain 3 covers the offensive side of credential-store theft. Drill the practice MCQs on exam.techclick.in to lock the concepts. All lessons → Practice on exam.techclick.in 📩 Quiz me on this in 7 days. Opt in and we'll email you 3 micro-questions from this lesson at Day 1, Day 7 and Day 30 — spaced repetition is how it sticks. Un-tick any time. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt