Microsoft Active Directory Domain Services Privilege Escalation Vulnerability (CVE-2021-42287) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWindows Server systems configured as Active Directory Domain Controllers (DCs).
A standard domain user can exploit Kerberos name resolution flaws to impersonate a Domain Controller computer account, escalating privileges to Domain Admin and compromising the entire AD forest.
Apply the latest Microsoft cumulative security updates to all Domain Controllers and enforce Kerberos validation hardening via registry configurations.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the November 2021 cumulative updates (or later) to all Domain Controllers in the forest. Use the following PowerShell commands to verify patch status and force updates if necessary.
# Check if the required cumulative updates are installed (e.g., KB5008212, KB5008233 depending on OS version)
Get-HotFix | Where-Object { $_.HotFixID -match 'KB5008212|KB5008233|KB5008302' }
# Install missing updates using the PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
To mitigate the risk before patching, restrict standard users from adding computer accounts to the domain. By default, any authenticated user can add up to 10 machine accounts (ms-DS-MachineAccountQuota). Set this value to '0' to block unauthorized machine account creation.
# Import Active Directory module and set MachineAccountQuota to 0
Import-Module ActiveDirectory
Set-ADDomain (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'=0}
# Verify the configuration change
Get-ADDomain | Select-Object -Property Name, @{Name='MachineAccountQuota';Expression={(Get-ADObject $_.DistinguishedName -Properties 'ms-ds-MachineAccountQuota').'ms-ds-MachineAccountQuota'}}3. Log Audit & IoC Verification Commands
Monitor Domain Controller security event logs for suspicious computer account modifications. Specifically, inspect Event ID 4741 (Computer Account Created) and Event ID 4742 (Computer Account Changed) for accounts created or modified without a trailing '$'.
# Query Event ID 4742 for computer accounts modified without a trailing '$' in the last 7 days
$StartDate = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4742; StartTime=$StartDate} -ErrorAction SilentlyContinue |
ForEach-Object {
$xml = [xml]$_.ToXml()
$targetName = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
if ($targetName -and -not $targetName.EndsWith('$')) {
[PSCustomObject]@{
TimeCreated = $_.TimeCreated
EventID = $_.Id
TargetUser = $targetName
SubjectUser = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
Message = 'Warning: Computer account modified without trailing dollar sign ($)'
}
}
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a privilege escalation flaw within Microsoft Active Directory Domain Services (AD DS) involving the Kerberos authentication protocol. By default, computer accounts in Active Directory end with a '$' character in their sAMAccountName. However, the Kerberos Key Distribution Center (KDC) contains a fallback mechanism: if a requested sAMAccountName during a service ticket request (TGS-REQ) is not found, the KDC automatically appends a '$' to the name and searches again. Attackers exploit this fallback logic to impersonate Domain Controllers.
2. Exploitation Mechanics & Attack Scenario
An attacker with standard domain user credentials executes the following steps:
- Creates a new computer account in the domain (e.g., 'temp-computer').
- Renames the sAMAccountName of this new computer account to match a legitimate Domain Controller's name but without the trailing '$' (e.g., 'DC01').
- Requests a Kerberos Ticket Granting Ticket (TGT) for the renamed account ('DC01').
- Immediately after receiving the TGT, renames the computer account back to its original name or deletes it.
- Requests a service ticket (TGS) using the previously obtained TGT.
- The KDC attempts to look up the account 'DC01' specified in the TGT. Since it no longer exists, the KDC's fallback mechanism appends a '$' and successfully resolves it to 'DC01$' (the actual Domain Controller). The KDC then issues a high-privilege service ticket, granting the attacker Domain Admin rights.
3. Infrastructure & Business Impact
As a highly critical vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this flaw poses an extreme risk. Successful exploitation allows any low-privileged domain user to achieve full Domain Administrator privileges within minutes. This leads to complete compromise of the Active Directory infrastructure, enabling lateral movement, ransomware deployment, and full data exfiltration across the enterprise network.
Official Vendor Advisories & References
Active Directory Domain Services Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2021-42287)
FAQQ1. How critical is CVE-2021-42287 and is it actively exploited in the wild?
CVE-2021-42287 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 77.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-42287?
Primary impacted vendors include microsoft across active directory domain services, windows server. Scope summary: All unpatched Windows Server versions (from Windows Server 2008 R2 up to Windows Server 2022) running Active Directory Domain Services (AD DS).
Q3. What temporary mitigations or workarounds exist for CVE-2021-42287 before patching?
[Mitigation] Apply the latest Microsoft cumulative security updates to all Domain Controllers and enforce Kerberos validation hardening via registry configurations. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-42287
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory
[Affected Scope] Windows Server environments with Active Directory Federation Services (AD FS) enabled
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.