Security News > 2021 > August > Windows security update blocks PetitPotam NTLM relay attacks
Microsoft has released security updates that block the PetitPotam NTLM relay attack that allows a threat actor to take over a Windows domain.
This NTLM relay attack allows the threat actor to take over the domain controller, and thus the Windows domain.
In July, Microsoft released a security advisory explaining how to mitigate NTLM relay attacks targeting Active Directory Certificate Services.
As part of the August 2021 Patch Tuesday updates, Microsoft has released a security update that blocks the PetitPotam vector, so it cannot force a domain controller to authenticate against another server.
"The EFS API OpenEncryptedFileRaw(A/W), often used in backup software, continues to work in all versions of Windows, except when backing up to or from a system running Windows Server 2008 SP2. OpenEncryptedFileRaw will no longer work on Windows Server 2008 SP2," warns Microsoft.
If your backup software no longer works after installing this update on Windows 7 Service Pack 1 or Windows Server 2008 R2 Service Pack 1 and later, Microsoft suggests you contact your backup software developer to get an updated version.
News URL
Related news
- Windows 11 Media Update Bug Stops Security Updates (source)
- Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them (source)
- Windows 10 users urged to upgrade to avoid "security fiasco" (source)
- Security pros baited with fake Windows LDAP exploit traps (source)
- Patch Tuesday: January 2025 Security Update Patches Exploited Elevation of Privilege Attacks (source)
- Balancing usability and security in the fight against identity-based attacks (source)
- 7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now (source)
- Microsoft: January Windows security updates break audio playback (source)
- Security pros more confident about fending off ransomware, despite being battered by attacks (source)
- Microsoft shares workaround for Windows security update issues (source)