CVE-2021-42287

What it actually does

This vulnerability affects Active Directory Domain Services on Windows Server domain controllers. It allows a low-privileged authenticated domain user to abuse Kerberos account name resolution and elevate privileges, commonly by combining it with the related Active Directory computer-account spoofing issue CVE-2021-42278. In a typical exploitation chain, the attacker creates or controls a machine account, manipulates its sAMAccountName so it resembles a domain controller account, obtains Kerberos tickets, and causes the Key Distribution Center to resolve the spoofed identity as a domain controller. Successful exploitation can allow the attacker to impersonate highly privileged AD identities, obtain domain-level access, perform DCSync-style credential theft, and fully compromise the domain.

Why it matters to the business

Successful exploitation can result in complete Active Directory domain compromise, meaning attackers may gain control over user accounts, servers, workstations, identity infrastructure, and business-critical applications that rely on the domain. Because this issue is listed in CISA KEV, has known active exploitation, has been associated with ransomware activity, and has a high EPSS score, it should be treated as an urgent identity-infrastructure risk rather than a routine server patching issue. Compromise can lead to credential theft, ransomware deployment, operational outage, regulatory exposure, and expensive domain recovery work.

How an attack unfolds

An attacker first obtains any valid low-privileged Active Directory user credential. In many default domains, that user can create a limited number of computer accounts because the MachineAccountQuota setting permits it. The attacker creates or takes over a computer account, changes its sAMAccountName to mimic a domain controller name without the expected trailing dollar sign, and requests Kerberos authentication material for that spoofed account. Due to the vulnerable KDC behavior, Active Directory can resolve the manipulated name as the real domain controller account. The attacker then uses Kerberos service ticket flows, commonly S4U operations, to impersonate privileged users or domain controller identities. With the resulting privileges, the attacker can dump domain secrets, perform DCSync, create persistence, disable defenses, and move laterally. Public exploitation chains and tools commonly refer to this attack path as noPac, and exploitation is often paired with CVE-2021-42278.

How to fix it

Apply Microsoft security updates released in November 2021 or later to all affected Windows Server domain controllers, including Windows Server 2008, 2012, 2016, 2019, and 2022 systems where still supported. Ensure every writable and read-only domain controller is patched; partial patching leaves the domain exposed because attackers can target any vulnerable domain controller. Where exact package versions are not available, use Microsoft’s official security update guidance for CVE-2021-42287 and the relevant Windows Server cumulative updates or security-only updates. Also patch CVE-2021-42278, because real-world exploitation commonly chains the two issues. As hardening, set MachineAccountQuota to 0 unless business processes require standard users to join computers to the domain, delegate computer-account creation only to controlled administrative groups or provisioning systems, monitor and restrict changes to sAMAccountName, remove stale or suspicious computer accounts, and enforce strong credential hygiene for privileged users. If exploitation is suspected, rotate KRBTGT twice following Microsoft guidance, reset credentials for affected privileged accounts, and review domain controller integrity before trusting the environment.

How to confirm the fix worked

Confirm that all domain controllers have the relevant November 2021 or later Microsoft security updates installed. Validate through centralized patch inventory, Windows Update history, Get-HotFix, system build numbers, or enterprise vulnerability scanning authenticated to each domain controller. Confirm that no unpatched domain controllers remain, including disaster-recovery, read-only, lab-connected, or rarely used domain controllers. Review the domain setting ms-DS-MachineAccountQuota and verify it is 0 or set according to a documented, risk-accepted provisioning model. Test whether an ordinary domain user can create and rename computer accounts inappropriately. Audit recent Event ID 4741, 4742, and 4781 activity for computer-account creation, modification, and rename behavior. Validate that monitoring detects computer accounts renamed to names that resemble domain controllers, computer accounts without a trailing dollar sign, and rapid create/rename/delete sequences. If the organization performs controlled security validation, use a safe, authorized test in a non-production domain or tightly scoped assessment to confirm the noPac-style attack path is blocked.

Typical attack path

1. Obtain valid low-privileged domain credentials through phishing, password reuse, malware, exposed services, or prior foothold.
2. Enumerate Active Directory domain controllers, domain name, Kerberos configuration, and whether standard users can create machine accounts.
3. Create a new computer account or use an attacker-controlled computer account in the domain.
4. Rename or manipulate the computer account sAMAccountName so it resembles a domain controller account name.
5. Request Kerberos tickets in a way that triggers vulnerable KDC account-name resolution behavior.
6. Use the resulting Kerberos ticket material to impersonate a privileged identity or domain controller.
7. Perform DCSync or equivalent directory replication abuse to extract credential material such as NTLM hashes and Kerberos keys.
8. Use stolen credentials or tickets to gain domain administrator-level control, deploy payloads, establish persistence, or support ransomware operations.

How to detect it

Look for evidence of low-privileged users creating or modifying computer accounts followed by Kerberos abuse and domain replication activity. Primary log sources are Windows Security logs on domain controllers, Directory Service logs, Kerberos authentication events, endpoint telemetry from systems used by administrators, EDR process telemetry, and network logs for LDAP, Kerberos, SMB, and DRSUAPI traffic. Review Event ID 4741 for computer account creation, Event ID 4742 for computer account changes, Event ID 4781 for account rename operations, Event ID 4768 for Kerberos TGT requests, Event ID 4769 for service ticket requests, Event ID 4624 for unusual privileged logons, Event ID 4662 for directory replication access, and Event ID 4732/4728/4756 for privileged group membership changes. Hunt for machine accounts whose sAMAccountName was changed from a normal computer-account format ending in '$' to a value that resembles a domain controller name or lacks the trailing '$'. Correlate rapid sequences where a user creates a computer account, renames it, requests Kerberos tickets, and then deletes or reverts the account. Investigate Kerberos activity from non-domain-controller hosts that is followed by DCSync-like replication requests against domain controllers. Search EDR and command-line telemetry for public tooling and scripts associated with noPac exploitation, Impacket Kerberos ticket operations, and secrets dumping. Because this vulnerability has been used in ransomware-related intrusions, also look for post-exploitation signs such as mass authentication attempts, remote service creation, PsExec-like execution, security tool tampering, unusual GPO changes, and staging of encryption payloads.

• Event ID 4741
• Event ID 4742
• Event ID 4781
• Event ID 4768
• Event ID 4769
• Event ID 4662
• Event ID 4728
• Event ID 4732
• Event ID 4756
• sAMAccountName
• ms-DS-MachineAccountQuota
• noPac.py
• sam_the_admin.py
• noPac.exe
• secretsdump.py
• getST.py
• addcomputer.py
• renameMachine.py
• Impacket
• DRSUAPI
• DS-Replication-Get-Changes
• DS-Replication-Get-Changes-All
• Replicating Directory Changes All
• Account Name Changed
• A computer account was created
• A computer account was changed

What your security team should do

• Immediately verify patch status for every Active Directory domain controller; prioritize remediation because the issue is in CISA KEV, is exploited in the wild, and has been associated with ransomware activity.
• Patch CVE-2021-42287 and the commonly chained CVE-2021-42278 across all domain controllers before considering the domain remediated.
• Reduce ms-DS-MachineAccountQuota to 0 unless there is a specific operational requirement, and delegate computer-account creation through controlled administrative workflows.
• Hunt for historical noPac-style exploitation using domain controller security logs, Kerberos events, directory service changes, and endpoint telemetry from administrative hosts.
• Alert on computer accounts renamed to resemble domain controllers, computer accounts missing a trailing dollar sign, and rapid machine-account create/rename/delete activity.
• Investigate any suspicious Kerberos ticket requests followed by directory replication activity, secrets dumping, privileged group changes, or lateral movement.
• If compromise is suspected, assume domain-level credential exposure; perform incident response, rotate privileged credentials, reset KRBTGT twice, and rebuild or validate domain controllers as needed.
• Review privileged group membership, delegation settings, AdminSDHolder changes, service principal names, new trusts, new GPOs, and newly created accounts for persistence.
• Block or tightly control use of offensive tooling commonly used in this attack chain, including Impacket-based scripts, noPac, and secretsdump, while recognizing that tool names alone are not sufficient detection.
• Preserve domain controller security event logs and directory service logs before log rollover, because exploitation evidence may age out quickly in busy domains.