Active Directory Domain Services Elevation of Privilege Vulnerability

CVE-2021-42278 is the Active Directory sAMAccountName spoofing bug behind *noPac*. On vulnerable domain controllers, a low-privileged authenticated domain user can create or control a computer account, rename it to mimic a domain controller name *without* the trailing $, and abuse AD DS validation gaps to impersonate a DC identity. Microsoft’s hardening applies to Windows Server domain controllers from 2008 SP2 through 2022 unless they had the November 9, 2021 security update or later.

Microsoft’s HIGH label is directionally right, but the real-world story is sharper: this is not an unauthenticated perimeter bug, yet once an attacker has *any* domain user and internal AD reachability, the blast radius is often the whole domain—especially when chained with CVE-2021-42287 as *noPac*. KEV listing, mature PoCs, and repeated ransomware/operator use keep this out of MEDIUM; the authenticated-internal requirement keeps it out of CRITICAL.

Why this verdict

• KEV and operator use push this up. This is not hypothetical; CISA KEV and later Black Basta reporting show real adversaries value the chain.
• Only low privilege is needed once inside. Requiring a basic domain user is real friction, but it is weak friction in large enterprises where user-level compromise is common.
• Blast radius is Tier 0. A successful chain moves from ordinary domain identity to DC impersonation and effectively domain-admin outcomes.
• Population is broad inside enterprises. Active Directory is ubiquitous, and many estates historically left machine-join permissions or machine account quota in an attacker-friendly state.
• Not perimeter-reachable keeps it below CRITICAL. The exploit path assumes internal reachability to DCs and an existing authenticated foothold, which compounds downward pressure versus unauthenticated edge bugs.

Why not higher?

This is not an unauthenticated internet-facing RCE. The attacker must already possess a valid domain account and be able to talk to domain controllers, which means the enterprise has already lost an earlier stage of the kill chain. That post-authentication requirement is meaningful enough to keep this out of CRITICAL even with a domain-wide payoff.

Why not lower?

Downgrading this to MEDIUM would ignore the real blast radius and the exploitation record. Once the prerequisites are met, tooling is mature, the chain is fast, and the result is often total AD control. KEV status is the tie-breaker: defenders should treat it as a top-priority HIGH, not routine backlog work.

1. Set machine-account quota to zero — Set ms-DS-MachineAccountQuota to 0 unless you have a documented exception process. This cuts off the easiest self-service computer-account creation path used in *noPac* and, because this CVE has exploitation evidence, do it immediately, within hours as temporary risk reduction.
2. Remove broad domain-join rights — Audit and restrict Add workstations to domain plus any delegated Create Computer Objects rights on OUs/containers. Limit these to controlled join accounts or automation only; complete the rollback of broad user access immediately, within hours where feasible, and finish exception cleanup no later than the normal HIGH window.
3. Normalize every DC and RODC to the same patch floor — Mixed patch states are where AD bugs stay exploitable. Make sure all domain controllers, including RODCs and neglected DR/test DCs, are on the post-2021-11-09 floor and not carrying disabled PAC validation states; for a KEV-listed issue, treat this as immediate, within hours triage.
4. Hunt the rename-and-ticket sequence — Alert on 4741, 4781, 4768, 4769, 16990, 16991, and KDC 35-38, especially a machine account renamed to lose the trailing $ followed by Kerberos ticket activity. Push this monitoring within hours because it is your best safety net while you validate patch uniformity.
5. Tier and segment DC access — Reduce which user workstations, VPN enclaves, and server tiers can reach LDAP/Kerberos on DCs. This does not fix the flaw, but it raises the cost of converting a random user compromise into a DC-targeting path; implement within 30 days at the latest for the HIGH bucket if not already in place.

Run this on each domain controller from an elevated PowerShell session. Example: powershell -ExecutionPolicy Bypass -File .\Test-CVE-2021-42278.ps1. It needs local admin rights to read OS/update state and works best on the target DC itself, not from an auditor workstation.

# Test-CVE-2021-42278.ps1

# Purpose: Assess whether a Windows host that is a Domain Controller appears patched for CVE-2021-42278

# and whether the practical noPac chain still has obvious CVE-2021-42287 weak-state indicators.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Out-Result {
    param(
        [string]$State,
        [string]$Reason,
        [int]$Code
    )
    Write-Output ("{0}: {1}" -f $State, $Reason)
    exit $Code
}

try {
    $cs = Get-CimInstance Win32_ComputerSystem
    if ($cs.DomainRole -notin 4,5) {
        Out-Result -State 'UNKNOWN' -Reason 'Host is not a domain controller (DomainRole != 4/5).' -Code 2
    }

    $os = Get-CimInstance Win32_OperatingSystem
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $caption = $os.Caption
    $build = [int]$cv.CurrentBuildNumber
    $ubr = [int]$cv.UBR

    # Check for obvious noPac weak-state if the legacy CVE-2021-42287 registry knob is still present and disabled.

    $pacValue = $null
    try {
        $kdc = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Services\Kdc' -ErrorAction Stop
        if ($null -ne $kdc.PacRequestorEnforcement) {
            $pacValue = [int]$kdc.PacRequestorEnforcement
        }
    } catch {
        $pacValue = $null
    }

    if ($pacValue -eq 0) {
        Out-Result -State 'VULNERABLE' -Reason 'PacRequestorEnforcement=0 indicates disabled legacy PAC requestor validation state; the noPac chain remains a concern.' -Code 1
    }

    # Precise NVD minimum safe build thresholds where available.

    $thresholds = @(
        @{ Match='Windows Server 2016'; Build=14393; MinUBR=4770 },
        @{ Match='Windows Server 2019'; Build=17763; MinUBR=2300 },
        @{ Match='Windows Server 2022'; Build=20348; MinUBR=350 },
        @{ Match='Windows Server, version 2004'; Build=19041; MinUBR=1348 },
        @{ Match='Windows Server, version 20H2'; Build=19042; MinUBR=1348 }
    )

    foreach ($t in $thresholds) {
        if ($caption -like "*$($t.Match)*") {
            if ($build -gt $t.Build -or ($build -eq $t.Build -and $ubr -ge $t.MinUBR)) {
                Out-Result -State 'PATCHED' -Reason ("{0} build {1}.{2} meets or exceeds minimum known fixed build {3}.{4}." -f $caption,$build,$ubr,$t.Build,$t.MinUBR) -Code 0
            } else {
                Out-Result -State 'VULNERABLE' -Reason ("{0} build {1}.{2} is below minimum known fixed build {3}.{4}." -f $caption,$build,$ubr,$t.Build,$t.MinUBR) -Code 1
            }
        }
    }

    # Legacy server fallback: later cumulative/security rollups also contain the fix, so use installed update recency as a heuristic.

    if ($caption -match 'Windows Server 2012|Windows Server 2008') {
        $cutoff = Get-Date '2021-11-09'
        $hotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
        if ($null -eq $hotfix) {
            Out-Result -State 'UNKNOWN' -Reason 'Could not enumerate installed hotfixes on this legacy DC.' -Code 2
        }
        if ($hotfix.InstalledOn -ge $cutoff) {
            Out-Result -State 'PATCHED' -Reason ("Legacy DC latest hotfix {0} was installed on {1:yyyy-MM-dd}; verify all DCs in the forest are similarly updated." -f $hotfix.HotFixID,$hotfix.InstalledOn) -Code 0
        } else {
            Out-Result -State 'VULNERABLE' -Reason ("Legacy DC has no evidence of post-2021-11-09 security servicing; latest hotfix {0} installed {1:yyyy-MM-dd}." -f $hotfix.HotFixID,$hotfix.InstalledOn) -Code 1
        }
    }

    Out-Result -State 'UNKNOWN' -Reason ("Unrecognized server release '{0}' (build {1}.{2}); assess manually against Microsoft/NVD guidance." -f $caption,$build,$ubr) -Code 2
}
catch {
    Out-Result -State 'UNKNOWN' -Reason $_.Exception.Message -Code 2
}

Sources

1. NVD CVE-2021-42278
2. Microsoft KB5008102 — AD SAM hardening changes (CVE-2021-42278)
3. Microsoft KB5008380 — Authentication updates (CVE-2021-42287)
4. Microsoft Learn — Add workstations to domain
5. Microsoft Learn — Active Directory domain join permissions
6. CISA KEV Catalog entry
7. Cloudbrothers — Exploit samAccountName spoofing with Kerberos
8. CISA / partners — #StopRansomware: Black Basta