Not seeing event 5829 since August's updates

MISAdmin 381 Reputation points
2020-09-16T16:43:48.41+00:00

In reference to August's changes with "How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472",

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

I am not seeing any 5829 events in the System logs on my DCs. The DC's are Server 2012 and I have Windows 7 clients out there so I thought I would start seeing these events, logging that a vulnerable Netlogon secure channel connection was allowed. Am I missing something?

Windows Server Infrastructure
Windows Server Infrastructure
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Infrastructure: A Microsoft solution area focused on providing organizations with a cloud solution that supports their real-world needs and meets evolving regulatory requirements.
516 questions

12 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2020-09-29T20:07:50.027+00:00

    It may be you've had no unsecure connections. On the problem member you can test from PowerShell.
    Test-ComputerSecureChannel
    https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

    --please don't forget to Accept as answer if the reply is helpful--

    1 person found this answer helpful.
    0 comments
  2. Dave Patrick 426.1K Reputation points MVP
    2020-09-30T18:06:15.007+00:00

    On the suspect members I'd test it from PowerShell.
    Test-ComputerSecureChannel

    --please don't forget to Accept as answer if the reply is helpful--

    1 person found this answer helpful.
  3. Dave Patrick 426.1K Reputation points MVP
    2020-09-30T18:13:34.47+00:00

    Sounds good,

    --please don't forget to Accept as answer if the reply is helpful--

    1 person found this answer helpful.
    0 comments
  4. Daisy Zhou 18,721 Reputation points Microsoft Vendor
    2020-09-17T09:30:05.493+00:00

    Hello @MISAdmin ,

    Thank you for posting here.

    If we does not see any event 5829 on any DC (Windows DCs and non-Windows DCs if we have in our domain), it means all the trust accounts and domain devices (Windows deveices and non-Windows deveices if we have in our domain) are compliant currently.

    From the link we mentioned above, we can see:

    By default, supported versions of Windows that have been fully updated should not be using vulnerable Netlogon secure channel connections. If one of these events is logged in the system event log for a Windows device:

    1.Confirm that the device is running a supported versions of Windows.
    2.Ensure the device is fully updated.
    3.Check to ensure that Domain member: Digitally encrypt or sign secure channel data (always) is set to Enabled.

    Maybe it will not affect the old operating system version machines (such as Windows 7), in your case, then there is no 5829 on any DC.

    If you have non-Windows DCs or non-Windows devices, it may log event 5829.

    So we can keep monitoring in the later days until February 9, 2021 - Enforcement Phase.

    Best Regards,
    Daisy Zhou

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  5. MISAdmin 381 Reputation points
    2020-09-21T11:16:12.473+00:00

    Hi Daisy. Thank you for the reply but I would like a confirmation about Windows 7 SP1 clients. It was my understanding that these are vulnerable. Can anyone confirm or clarify this?

    0 comments