Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42278) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTAll Windows Server Domain Controllers (from 2008 to 2022) running Active Directory Domain Services (AD DS)
A standard domain user can spoof a Domain Controller's computer account name, escalate privileges to Domain Admin, and achieve full domain compromise
Apply the latest Microsoft cumulative security updates and ensure the KB5008380 registry settings are transitioned to Enforcement mode
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately apply the cumulative security updates released on or after November 9, 2021 (such as KB5008380) to all Domain Controllers in the environment.
Use PowerShell to verify the installation of the required hotfix or force the update:
# Check if KB5008380 or a later cumulative update is installed
Get-HotFix -Id KB5008380
# If missing, install the update using the PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -Install -KBArticleID KB5008380 -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, mitigate the risk by setting the MachineAccountQuota to 0 to prevent standard users from creating new computer accounts.
Execute the following Active Directory PowerShell commands to restrict computer account creation:
# Retrieve the current MachineAccountQuota value
Get-ADDomain | Select-Object -Property DistinguishedName, MachineAccountQuota
# Restrict standard users from creating computer accounts (set quota to 0)
Set-ADDomain -Identity (Get-ADDomain).DistinguishedName -MachineAccountQuota 03. Log Audit & IoC Verification Commands
Audit the Domain Controller security event logs for Event ID 4741 (Computer Account Created) and Event ID 4742 (Computer Account Changed) to identify computer accounts created without a trailing $ in their sAMAccountName.
Run the following PowerShell script to detect potential indicators of compromise (IoCs):
# Scan for computer accounts created or modified in the last 7 days lacking a trailing '$'
$StartDate = (Get-Date).AddDays(-7)
$Events = Get-WinEvent -FilterHashtable @{
LogName = 'Security'
Id = 4741, 4742
StartTime = $StartDate
} -ErrorAction SilentlyContinue
foreach ($Event in $Events) {
$Xml = [xml]$Event.ToXml()
$SamName = ($Xml.Event.EventData.Data | Where-Object { $_.Name -eq 'TargetUserName' }).'#text'
if ($SamName -and -not $SamName.EndsWith('$')) {
Write-Warning 'Suspicious computer account detected (sAMAccountName lacks trailing $):'
Write-Host 'Event ID:' $Event.Id
Write-Host 'Account Name:' $SamName
Write-Host 'Time Created:' $Event.TimeCreated
Write-Host '----------------------------------------'
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability stems from a design flaw in how Active Directory Domain Services (AD DS) validates and processes the sAMAccountName attribute of computer accounts. By default, computer account names in AD end with a trailing dollar sign (e.g., DESKTOP-01$). However, AD DS did not strictly enforce the presence of the trailing $ during computer account creation or modification. This allowed standard domain users to rename computer accounts they controlled to names resembling domain controllers or other users without the trailing $, creating a significant security loophole.
2. Exploitation Mechanics & Attack Scenario
An attacker with standard domain user credentials can escalate privileges using the following methodology:
- Computer Account Creation: The attacker leverages the default
MachineAccountQuotaprivilege to create a new computer account (e.g.,TEMP-PC$). - Name Spoofing: The attacker renames the
sAMAccountNameof this account to match a target Domain Controller's name but without the trailing$(e.g., renaming it toDC01if the target DC isDC01$). - Kerberos Ticket Request: The attacker requests a Kerberos Ticket Granting Ticket (TGT) for the spoofed account name (
DC01). - Name Restoration & TGS Request: After obtaining the TGT, the attacker renames the computer account back to its original name (
TEMP-PC$). The attacker then requests a Ticket Granting Service (TGS) ticket for the Domain Controller service using the previously acquired TGT. - Domain Admin Escalation: When the AD Key Distribution Center (KDC) processes the TGS request, it fails to find the account
DC01and automatically appends a$to search forDC01$. Consequently, the KDC issues a service ticket with Domain Admin privileges, mistaking the attacker for the actual Domain Controller.
3. Infrastructure & Business Impact
This vulnerability is highly critical and has been actively exploited in the wild, as evidenced by its inclusion in the CISA KEV catalog. If an attacker compromises even a single low-privileged domain user account, they can escalate to Domain Admin within seconds. This leads to complete compromise of the Active Directory forest, enabling data exfiltration, ransomware deployment, and persistent threat actor presence across the entire corporate network.
Official Vendor Advisories & References
Active Directory Domain Services Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2021-42278)
FAQQ1. How critical is CVE-2021-42278 and is it actively exploited in the wild?
CVE-2021-42278 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 73.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-42278?
Primary impacted vendors include microsoft across active directory domain services, windows server. Scope summary: All versions of Windows Server (2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022) configured as Active Directory Domain Controllers
Q3. What temporary mitigations or workarounds exist for CVE-2021-42278 before patching?
[Mitigation] Apply the latest Microsoft cumulative security updates and ensure the KB5008380 registry settings are transitioned to Enforcement mode Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-42278
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.