How Could PetitPotam Relay a Domain Controller's Authentication to AD CS?

Active Directory Certificate Services (AD CS) has two role services that accept certificate requests over the web: Certificate Authority Web Enrollment, used from a browser, and Certificate Enrollment Web Service, used from Windows’ built-in client. PetitPotam was an attack that exploited the state in which these role services accepted relayed NTLM authentication.¹²³

The attacker first makes a domain controller authenticate with NTLM to a server on the attacker’s side. The attacker then relays that authentication as-is to AD CS web enrollment. CVE-2021-36942 is the vulnerability that coerces the first half, the authentication, and Microsoft rates the severity when it is combined with the second half, the relay to AD CS, at a CVSS base score of 9.8.⁴⁵

1. Overview

CVE-2021-36942 is a Windows Server vulnerability published on August 10, 2021. An unauthenticated attacker who called a method on the LSARPC interface could make a domain controller authenticate to another server using NTLM.⁶⁴ Before that, on July 23, 2021, Microsoft published advisory ADV210003 and KB5005413 in response to PetitPotam.⁷

Microsoft’s record at the time of publication listed exploitation as “No”. CISA later added it to the Known Exploited Vulnerabilities Catalog, and in a December 2024 article Microsoft also confirmed that it had been exploited for relaying to AD CS.⁶¹⁰¹¹

flowchart TB
    accTitle: The two stages that make up PetitPotam
    accDescr: Shows the stage in which CVE-2021-36942 makes a domain controller send NTLM authentication, and the stage in which that authentication is relayed to AD CS web enrollment.
    A["Call an EFSRPC method through LSARPC"] --> B["Domain controller sends NTLM authentication"]
    B --> C["Attacker relays it to AD CS web enrollment"]
    C --> D{"Does AD CS have relay protection?"}
    D -->|"No"| E["Authenticated as the domain controller"]
    D -->|"Has EPA or similar"| F["Relayed authentication is not accepted"]

Figure 1: CVE-2021-36942 is the first-half coercion; the size of the damage is decided by the protection on AD CS in the second half.⁴⁸

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (19 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. Affected Systems

The CVE-2021-36942 update applied to the versions of Windows Server that were supported at the time of publication. These are Windows Server 2008 SP2 through 2019, plus versions 2004 and 20H2; client versions of Windows are not listed. Microsoft states that all servers are affected and advises updating domain controllers first.¹²¹³

For the relay to AD CS, KB5005413 describes the configurations that may be affected: those that use either of the following AD CS role services.¹

• Certificate Authority Web Enrollment
• Certificate Enrollment Web Service

For the attack to work, NTLM authentication must also be usable in the domain, and the web enrollment role service must lack protection against NTLM relay. KB5005413 explains that to prevent NTLM relay on networks where NTLM is enabled, services that accept NTLM authentication need to use protections such as EPA or SMB signing.⁸

flowchart TB
    accTitle: Conditions under which relaying to AD CS works
    accDescr: Relaying works when NTLM is usable in the domain, an AD CS web enrollment role service exists, and it has no protection against NTLM relay.
    A{"Is NTLM authentication usable in the domain?"} -->|"No"| X["No authentication to relay"]
    A -->|"Yes"| B{"Is there a web enrollment role service?"}
    B -->|"No"| Y["Outside the scope of KB5005413"]
    B -->|"Web Enrollment or Enrollment Web Service"| C{"Is there protection such as EPA?"}
    C -->|"Yes"| Z["Relayed authentication is rejected"]
    C -->|"No"| D["Relayed authentication is accepted"]

Figure 2: The outcome depends on whether the AD CS web enrollment role service accepts NTLM without protection.¹⁸

3. Details

EFSRPC accepted over LSARPC

Remote operations on the Encrypting File System use an RPC protocol called MS-EFSR (Encrypting File System Remote Protocol). The specification says EFSRPC messages SHOULD be sent to the named pipe \pipe\efsrpc, and that the server MAY respond to messages sent to \pipe\lsarpc. Both are named pipes over SMB.⁹

This interface includes, for example, EfsRpcOpenFileRaw. Its role in the specification is to open an encrypted object on the server for backup or restore.¹⁴ The CVE-2021-36942 update stopped calls to OpenEncryptedFileRawA and OpenEncryptedFileRawW through the LSARPC interface.⁴

flowchart TB
    accTitle: The two endpoints of MS-EFSR
    accDescr: Shows that EFSRPC messages are normally sent to the named pipe efsrpc, and that the server may also respond to messages sent to lsarpc.
    A["EFSRPC messages"] --> B["SMB named pipes"]
    B --> C["\pipe\efsrpc (SHOULD be used)"]
    B --> D["\pipe\lsarpc (MAY respond)"]
    D --> E["August 2021 update stopped specific API calls"]

Figure 3: What the CVE-2021-36942 update stopped was specific API calls through LSARPC.⁹⁴

Coercing authentication without being authenticated

According to MSRC’s explanation, an unauthenticated attacker could call a method on the LSARPC interface and make a domain controller authenticate to another server using NTLM.⁴ In other words, the domain controller itself starts NTLM authentication to a server the attacker has prepared.

What the attacker gets at this stage is an NTLM authentication in progress, sent by the domain controller. CVE-2021-36942 on its own is rated at a CVSS base score of 7.5 (high impact on confidentiality). How much damage results depends on where this authentication can be relayed.⁶⁵

flowchart TB
    accTitle: How NTLM authentication starts from an unauthenticated call
    accDescr: Shows the flow from the attacker calling a method through LSARPC to the domain controller starting NTLM authentication to another server.
    A["Attacker calls an LSARPC method"] --> B["Domain controller connects to another server"]
    B --> C["NTLM authentication as the domain controller"]
    C --> D["Attacker receives the authentication in progress"]

Figure 4: The call required no authentication, and the domain controller started authenticating on its own.⁴

Relaying to AD CS web enrollment

KB5005413 calls PetitPotam “a classic NTLM Relay Attack”. In an NTLM relay, the attacker relays the authentication it receives to a different service, passes the challenge from that service to the victim, and returns the response the victim computed to the service.⁸¹⁵

The relay targets were the two AD CS web enrollment role services. Certificate Enrollment Web Service accepts certificate requests over HTTPS and completes certificate enrollment with the certification authority (CA) on behalf of the requester. With Windows integrated authentication, it authenticates the requester using Kerberos or NTLM.² Certificate Authority Web Enrollment also accepts certificate requests on a website hosted in IIS.³

If the relayed NTLM authentication is accepted as-is, AD CS treats the requester as the domain controller. Microsoft Defender for Identity has an alert that corresponds to this situation, “Suspicious Domain Controller certificate request (ESC8)”.¹⁶ Microsoft describes a successful NTLM relay as an initial foothold for further compromising the domain.¹⁷

flowchart TB
    accTitle: How a domain controller's authentication is relayed to AD CS
    accDescr: Shows the flow from the attacker relaying the domain controller's authentication to AD CS web enrollment until AD CS treats the request as coming from the domain controller.
    A["Domain controller's NTLM authentication"] --> B["Attacker relays it"]
    B --> C["AD CS web enrollment"]
    C --> D["Relays the challenge and returns the response"]
    D --> E["AD CS treats the requester as the domain controller"]
    E --> F["Certificate request in the domain controller's name"]

Figure 5: When AD CS web enrollment accepted NTLM, a request in the domain controller’s name could go through with relayed authentication.⁸²¹⁶

How EPA stops the relay

EPA (Extended Protection for Authentication) is a mechanism that adds information to Windows authentication to prevent authentication relay and man-in-the-middle attacks. EPA in IIS mainly uses a channel binding token (CBT), used for SSL/TLS connections, and binding through the service principal name (SPN).¹⁸ According to Microsoft’s advisory 973811, authentication requests that use EPA are bound both to the SPN of the destination and to the outer TLS channel.¹⁹

The relayed authentication that AD CS receives was started by the domain controller with the attacker. It contains no information bound to the TLS channel between the attacker and AD CS. For that reason, AD CS with EPA required can reject authentication that is not bound to the channel. However, if the check is set to Require in IIS, clients that do not support EPA can no longer authenticate.¹⁸ Also, EPA applies to NTLMv2, Kerberos, Digest and Negotiate authentication, and does not apply to NTLMv1.²⁰

flowchart TB
    accTitle: Why EPA rejects relayed authentication
    accDescr: Shows that on a legitimate connection the authentication is bound to the TLS channel, while relayed authentication is not, so a server that requires EPA can reject it.
    A{"Is the authentication bound to the TLS channel with AD CS?"} -->|"Bound"| B["Accepted as a legitimate connection"]
    A -->|"Not bound"| C["Relayed authentication"]
    C --> D{"Is EPA required?"}
    D -->|"Required"| E["Authentication rejected"]
    D -->|"Disabled"| F["Accepted anyway"]

Figure 6: EPA binds the authentication to the TLS channel it came through.¹⁸¹⁹

4. Impact

What CVE-2021-36942 alone causes is making a domain controller send its authentication to the attacker’s side. Microsoft rates this at a CVSS base score of 7.5, and rates the combination with NTLM relay to AD CS at 9.8.⁶⁵

The problem in the combination is being authenticated as the victim at the relay destination. Microsoft explains that with NTLM relay, an attacker who relays credentials to an unprotected endpoint can authenticate and perform actions on behalf of the victim, and that this becomes an initial foothold for further domain compromise.¹⁷ In PetitPotam, the victim is the domain controller.

Actual exploitation has also been confirmed. CISA added CVE-2021-36942 to the Known Exploited Vulnerabilities Catalog on November 3, 2021, and lists its use in ransomware campaigns as “Known”.¹⁰ Microsoft also cites CVE-2021-36942, in which authentication coerced through LSARPC was relayed to AD CS, as an example of attackers targeting services that lack protection against NTLM relay.¹¹

In May 2022, CVE-2022-26925 was published; it likewise coerces NTLM authentication from domain controllers through LSARPC. Its update detects and rejects anonymous connection attempts to LSARPC, and it too was already being exploited at the time of publication. Microsoft references the same ADV210003 and KB5005413 for this vulnerability as well.²¹

flowchart TB
    accTitle: Impact when the coercion vulnerability meets missing AD CS protection
    accDescr: Shows that CVE-2021-36942 alone is CVSS 7.5, that combined with NTLM relay to AD CS it is 9.8, and that it becomes a foothold for further domain compromise.
    A["Coercion through CVE-2021-36942"] --> B["CVSS 7.5 on its own"]
    A --> C{"Does the target AD CS have protection?"}
    C -->|"No"| D["CVSS 9.8 in combination"]
    D --> E["Authenticated as the domain controller"]
    E --> F["Foothold for further domain compromise"]
    C -->|"Yes"| G["The relay fails"]

Figure 7: What changes the severity most is whether the relay destination has protection against NTLM relay.⁶⁵¹⁷

5. Mitigation

Update Windows Server

First, apply the latest updates for supported Windows Server versions, which include the fixes for CVE-2021-36942 and CVE-2022-26925. Microsoft advises prioritizing domain controllers.¹³²¹ On Windows Server 2008 SP2 with the August 2021 update installed, OpenEncryptedFileRaw no longer works.²²

The update alone is not enough, however. MSRC’s FAQ answers “Yes” to the question of whether additional steps are needed after the update, and refers to KB5005413.⁵ This is because the update stopped specific calls and anonymous connections through LSARPC, while the state in which AD CS accepts relayed NTLM remains.⁴²¹⁸

Require EPA on AD CS and stop HTTP

The primary mitigation in KB5005413 is to enable EPA on the AD CS servers and stop HTTP. The steps are as follows.²³

1. In IIS Manager, enable EPA for Certificate Authority Web Enrollment. Set the value to Required, which is the more secure and recommended option.
2. Likewise, set EPA to Required for Certificate Enrollment Web Service.
3. For Certificate Enrollment Web Service, also add <extendedProtectionPolicy> to %windir%\systemdata\CES\<CA name>_CES_Kerberos\web.config. When IIS is set to Required, the value is Always.
4. Enable Require SSL so that only HTTPS connections are accepted.
5. Run iisreset /restart from an administrator command prompt to load the changes. This command stops all running IIS services and starts them again.

Once EPA is required, clients that do not support EPA can no longer authenticate to AD CS web enrollment.¹⁸ Check first which clients request certificates as part of your business, and decide on a time window before making the change.

On Windows Server 2025, EPA for AD CS is enabled by default. However, the default value is “Enabled - When Supported”, which also accepts clients that do not present channel binding. Microsoft recommends “Enabled – Always” in environments that do not need to support older clients. On Windows Server 2022 and 2019, administrators enable EPA manually.²⁴

flowchart TB
    accTitle: Steps to protect AD CS web enrollment
    accDescr: Shows the order of requiring EPA for Certificate Authority Web Enrollment and Certificate Enrollment Web Service, updating web.config, requiring SSL and restarting IIS.
    A["Require EPA for Web Enrollment"] --> B["Require EPA for Enrollment Web Service"]
    B --> C["Set Always in web.config"]
    C --> D["Require SSL and stop HTTP"]
    D --> E["Restart IIS"]
    E --> F["Test a certificate request to confirm"]

Figure 8: The primary mitigation in KB5005413 is to require EPA and accept only HTTPS.²³

Reduce NTLM

In addition to the primary mitigation, KB5005413 recommends disabling NTLM authentication where possible. It lists the following three options, from more secure to less secure.²⁵

1. On domain controllers, disable NTLM authentication in the domain with the Network security: Restrict NTLM: NTLM authentication in this domain policy.
2. On the AD CS servers, set Network security: Restrict NTLM: Incoming NTLM traffic to Deny All Accounts or Deny All domain accounts. Add any necessary exceptions with Add server exceptions in this domain.
3. In IIS running Certificate Authority Web Enrollment and Certificate Enrollment Web Service, set Windows authentication to Negotiate:Kerberos.

Each of these may stop business traffic that uses NTLM, so do not jump straight to denying. First use auditing to find out which clients and services use NTLM. The procedure is explained in the article on the NTLM deprecation.

In January 2026, Microsoft announced a plan to disable network NTLM by default in the next major release of Windows Server. NTLM will remain in the OS and can be explicitly re-enabled through policy, and the timing is subject to change.²⁶

flowchart TB
    accTitle: Three ways to reduce NTLM, in order of security
    accDescr: Lists disabling NTLM on domain controllers, denying incoming NTLM on AD CS servers, and Kerberos-only authentication in IIS, in order from most secure.
    A["Use auditing to find who uses NTLM"] --> B["1. Disable NTLM authentication in the domain"]
    A --> C["2. Deny incoming NTLM on AD CS"]
    A --> D["3. Set IIS to Negotiate:Kerberos"]
    B ~~~ C
    C ~~~ D

Figure 9: KB5005413 lists three options, from the whole domain down to IIS only, in order of security.²⁵

Check the NTLM and AD CS records

When Network security: Restrict NTLM: Audit NTLM authentication in this domain is enabled, NTLM use in the domain is recorded as event 8004 on domain controllers. It is written to the Operational log under Applications and Services Log\Microsoft\Windows\NTLM, and the audit policy itself does not block any traffic.²⁷

On Windows 11 24H2 and Windows Server 2025, enhanced NTLM auditing events are recorded in the same Operational log by default. Clients log 4020 and 4021, servers log 4022 and 4023, and domain controllers log 4030 through 4033. The records include a field showing whether channel binding is supported, and they become warnings when EPA is not supported or insecure. They are also available on Windows Server 2022 and 2019 once updates from October 13, 2026 onward are installed.²⁸

In AD CS, when auditing of Certification Services is enabled, event 4886 is recorded when a certificate request is received and 4887 when it is approved and a certificate is issued.²⁹ Microsoft Defender for Identity has an alert that detects EFS-RPC abuse against domain controllers (external ID 2416), and an ESC8 alert detected by the AD CS sensor.³⁰¹⁶

flowchart TB
    accTitle: Where the records related to PetitPotam are kept
    accDescr: Shows NTLM auditing on domain controllers, the enhanced NTLM events, auditing of certificate requests in AD CS, and Defender for Identity alerts.
    A["Domain controllers"] --> A1["Event 8004 in the NTLM Operational log"]
    A1 ~~~ B["Each Windows machine"]
    B --> B1["Enhanced NTLM events 4020 to 4033"]
    B1 ~~~ C["AD CS"]
    C --> C1["Certificate request 4886 and issuance 4887"]
    C1 ~~~ D["Defender for Identity"]
    D --> D1["EFS-RPC abuse 2416 and ESC8"]

Figure 10: Use each record to check who uses NTLM, channel binding support, and certificate requests.^27282930

6. Lessons

What follows are design and operational observations drawn from the published history and mitigations.

With PetitPotam, the calls that coerced authentication were stopped one after another by the updates for two CVEs. The 2021 update stopped specific API calls, and the 2022 update rejected anonymous connections to LSARPC.⁴²¹ Even so, Microsoft asks for the KB5005413 steps with both updates.⁵²¹ This suggests that, apart from updates that stop the means of coercion, the relay destination services need to be kept in a state where they do not accept relayed NTLM. Even if one means of coercion is stopped, as long as the relay destination accepts unprotected NTLM, another means can lead to the same damage.

When building or operating a service that accepts NTLM, you need to check whether that service can tell relayed authentication apart. What KB5005413 asks for, too, is that services accepting NTLM use protections such as EPA or signing.⁸ The same question applies if you have in-house business systems that use Windows authentication in IIS.

Even with the defaults of Windows Server 2025, EPA for AD CS stays at “When Supported”. Whether the default is enough has to be decided after checking what your clients support.²⁴

This article explains the mechanism and the mitigations based on published primary sources. No work was done to reproduce the coercion or relay of authentication or the issuance of certificates.

Related Articles

• Why Did Outlook Send an NTLM Response Before the Email Was Even Opened?
• Will NTLM Deprecation Stop Your Business Apps?
• NTLM and Kerberos Explained with Diagrams
• SMB Signing and LDAP Channel Binding
• The Windows Certificate Store in Practice

References

The footnotes on the body text, tables and figures, and the source links in the FAQ, lead to the sections and items of the supporting documents. Where an explanation was assembled from a specification or is a design observation, the footnote says so. All sources were checked on October 31, 2026. Guidance from the original 2021 publication is described separately from the defaults and plans as of the check date.

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These are topic pages close to this theme. Starting from the article, you can go on to related services and other articles.

Services Connected to This Topic

This article leads to the following service pages. Start from the entry point closest to your situation.

Frequently Asked Questions

Questions commonly asked at the time of consultation about the topic of this article.

Is installing the August 2021 security update enough to deal with PetitPotam?

No. Microsoft states that in addition to the update, AD CS must be protected as described in KB5005413. The update stopped specific API calls through LSARPC; the state in which AD CS accepts relayed NTLM has to be fixed separately.

References

• MSRC CVE-2021-36942 FAQ (OpenEncryptedFileRaw / KB5005413)

Are environments that do not use AD CS affected?

KB5005413 identifies environments that use Certificate Authority Web Enrollment or Certificate Enrollment Web Service in AD CS as potentially affected. However, Microsoft advises applying the CVE-2021-36942 update to all Windows Servers, starting with domain controllers.

References

• KB5005413 (Certificate Authority Web Enrollment / Certificate Enrollment Web Service)
• MSRC CVE-2021-36942 FAQ (domain controllers should be prioritized)

Is AD CS on Windows Server 2025 safe without changing any settings?

On Windows Server 2025, EPA for AD CS is enabled by default, but the default value is “Enabled - When Supported”, which also accepts clients that do not present channel binding. Microsoft recommends the stronger “Enabled – Always” in environments that do not need to support older clients.

References

• MSRC: Mitigating NTLM Relay Attacks by Default (EPA defaults in Windows Server 2025)

Does enabling EPA also prevent relaying NTLMv1?

No. Microsoft explains that EPA applies to NTLMv2, Kerberos, Digest and Negotiate authentication, and does not apply to NTLMv1. Use of NTLMv1 has to be identified and stopped separately.

References

• KB5021989: Extended Protection for Authentication (does not apply to NTLMv1)

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and bug investigation, with particular strength in projects where existing assets remain and in investigating failures whose cause is hard to see.