Security News > 2021 > July > Microsoft warns of credential-stealing NTLM relay attacks against Windows domain controllers
To ward off the attack known as PetitPotam, Microsoft advises you to disable NTLM authentication on your Windows domain controller.
Microsoft is sounding an alert about a threat against Windows domain controllers that would allow attackers to capture NTLM credentials and certificates.
Dubbed a classic NTLM relay attack by Microsoft, the process works by abusing a Windows protocol known as MS-EFSRPC, which lets computers work with encrypted data on remote systems, The Record said.
As previously described in a Microsoft support document from 2009, NTLM relay attacks have been around for a number of years.
In a support document, Microsoft explained that your organization is potentially vulnerable to PetitPotam if NTLM authentication is enabled on your domain and you use Active Directory Certificate Services with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.
"To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication or signing features such as SMB signing," Microsoft said.
News URL
Related news
- Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054) (source)
- Windows NTLM hash leak flaw exploited in phishing attacks on governments (source)
- CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download (source)
- Microsoft's killing script used to avoid Microsoft Account in Windows 11 (source)
- Microsoft tests new Windows 11 tool to remotely fix boot crashes (source)
- New Windows 11 trick lets you bypass Microsoft Account requirement (source)
- Microsoft adds hotpatching support to Windows 11 Enterprise (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- Microsoft starts testing Windows 11 taskbar icon scaling (source)
- Windows 11 Forces Microsoft Account Sign In & Removes Bypass Trick Option (source)