PetitPotam: patch, then break the relay
The NTLM coercion that turns one RPC call into a domain admin certificate. Patch the DCs, then make the relay fail: HTTPS and EPA on AD CS web enrolment, or remove the role outright.
01 The Big PictureFor leadership · no jargon
Okay, so PetitPotam: the one where your own servers can be sweet-talked into introducing themselves to an attacker. Published in July 2021 by French researcher Gilles Lionel (topotam), it needs no stolen password, no malware, no phished laptop to get started. One politely crafted request and a Windows server, domain controllers included, wanders off and authenticates to a machine the attacker controls, handing over its own credentials. Think of it as convincing the office receptionist to phone a stranger and say the safe code: the receptionist isn't hacked, just helpful. Yikes.
Why does that phone call matter? Because of who's listening. Most organisations run an internal certificate service, the office that issues digital ID cards for servers and users, and many still have its self-service web pages switched on. Those pages trusted the caller's credentials without question, so an attacker could relay the domain controller's introduction straight there and walk away with an ID card made out to the most powerful account in the building. With that card: every password hash in the company, every server, every file is in attacker hands. Public exploit code was available from day one, ransomware crews adopted it within weeks, and it still shows up in pentest reports today.
The work is two parts. First, make sure your domain controllers have the August 2021 security updates or anything newer, on a maintained estate that's ancient history. Second, the part people miss: Microsoft's patch deliberately closed only the worst version of the trick, so the certificate service needs hardening too, or better, its web pages switched off if nothing uses them. Minutes to hours per server, no data loss, and the only trade-off is if something genuinely relies on requesting certificates through a browser.
02 Technical BreakdownFor engineers
PetitPotam abuses MS-EFSRPC, the Encrypting File System Remote Protocol, which is meant for things like backing up encrypted files. The function everyone knows is EfsRpcOpenFileRaw: you hand it a file path, and the server helpfully opens it. Hand it a UNC path pointing at an attacker machine and the server connects out to you instead. The fatal detail (spotted in the 0patch analysis): the filename is processed outside the client-impersonation block, so the connection isn't made as the calling user but as the server itself, its machine account. On a domain controller that's DC$, which holds the keys to the entire kingdom.
Pre-patch, this worked truly anonymously over the \pipe\lsarpc endpoint (the code lives in efslsaext.dll, inside lsass, which matters later). A second endpoint, \pipe\efsrpc, needs authentication, and several sibling functions (EfsRpcEncryptFileSrv, EfsRpcDecryptFileSrv and friends) coerce just as happily.
The relay target is Active Directory Certificate Services (AD CS) web enrolment: IIS pages under /certsrv, or the Certificate Enrollment Web Service, which by default took NTLM over HTTP with no Extended Protection for Authentication. This is ESC8 from SpecterOps' Certified Pre-Owned research, published about a month before PetitPotam dropped; PetitPotam just supplied the perfect credential to feed it. Relay DC$'s authentication there, request a certificate, use PKINIT to swap the cert for a Kerberos TGT as the DC (Rubeus or kekeo does the honours), then DCSync every hash in the domain. Foothold to full domain compromise in minutes.
Microsoft's fix, shipped 10 August 2021 as CVE-2021-36942 (CVSS 7.5), blocks the unauthenticated EfsRpcOpenFileRaw call over LSARPC. Deliberately partial, though: CERT/CC's advisory (VU#405600) that the EFSRPC interface stays reachable to authenticated users and other EFSRPC functions stay exposed, and Microsoft has said it won't service authenticated coercion. May 2022's CVE-2022-26925 tightened anonymous LSARPC access further after a bypass, and topotam's own summary afterwards: every PetitPotam function still works, except EfsRpcOpenFileRaw. Which is why this guide spends most of its time on configuration rather than patches: you can't patch the relay away, you have to make it fail.
03 Affected
Every Windows version from the era, server and client, with domain controllers the prize: Server 2008 SP2 through Server 2025 and beyond. The original unauthenticated coercion works on anything missing the August 2021 updates. The full domain-takeover chain additionally needs AD CS web enrolment (or the Certificate Enrollment Web Service, or NDES) installed somewhere and accepting NTLM.
The uncomfortable bit, five years on: authenticated coercion was never patched and, afaik, still works on fully updated systems today. So "affected" in practice means any domain where an attacker holds one low-privilege credential or a foothold, plus somewhere to relay to. If you run AD CS web enrolment without EPA and HTTPS, that's you.
04 Detection
Before we change anything, let's see what we're dealing with. First, patch level on the DCs:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOnThe newest cumulative update wants to be August 2021 or later; May 2022 or later also catches CVE-2022-26925. On any maintained estate this is long done, but check rather than assume.
Next, is web enrolment even installed? On each certificate authority:
Get-WindowsFeature ADCS-Web-Enrollment, ADCS-Cert-AuthorityRead the output carefully: "Available" means installable, not installed, a distinction that famously confused half of system admins at the time. You're looking for Installed in the Install State.
Now the hunt. Coercion attempts leave a fingerprint on the target:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5145} -MaxEvents 500 | Where-Object {$_.Message -match 'lsarpc|efsrpc'} Event 5145 records detailed file-share access; a hit for the lsarpc or efsrpc named pipes over IPC$, especially as ANONYMOUS LOGON, is the coercion attempt. Pair it with 4624 logon type 3 events using NTLM on the same Logon ID.
On the CA, check who's been enrolling:
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Pattern 'certfnsh.asp' | Select-Object -Last 10 A POST to certfnsh.asp followed by a GET of certnew.cer is a certificate being collected (path shown is the default for the first site). Any source IP you can't explain doing that is a relay until proven otherwise. Also worth hunting: 4768 TGT requests for machine accounts (the name ends in $) that carry certificate information; there's a public Sigma rule for exactly this.
Finally, check your own exposure from the outside, the same way a pentester would:
nxc smb <dc-ip> -u 'USERNAME' -p 'PASSWORD' -M coerce_plusNetExec's coerce_plus module probes for PetitPotam and its extended family (DFSCoerce, ShadowCoerce, the lot). If a fully patched DC still answers, you've just demonstrated why the rest of this guide exists.
05 Remediation
01 Install the security updates
Necessary but not sufficient, which is the whole trick with this one. Any cumulative update from August 2021 onward blocks the unauthenticated call; May 2022 onward adds the CVE-2022-26925 tightening. On a maintained estate, done years ago.
Install-Module PSWindowsUpdate; Get-WindowsUpdate -Install -AcceptAllOr push via WSUS/SCCM rings. Legacy and frozen systems first; those are the ones scanners will still flag for the anonymous vector.
02 Harden AD CS web enrolment (KB5005413)
If the web enrolment role must stay, this is the mitigation that actually breaks the relay, from Microsoft's advisory ADV210003 (KB5005413). On the CA, in IIS Manager: require SSL on the CertSrv application (and on the CES application if present), set Extended Protection for Authentication to Required, and remove NTLM from the Windows Authentication providers so only Negotiate:Kerberos remains. Then restart IIS:
iisreset /restart Three gotchas the KB doesn't exactly shout about. One: EPA does nothing unless Require SSL is on (CERT/CC's words, not mine). Two: you need a proper TLS certificate on the site before you can require SSL, a step the KB rather glosses over. Three: if you flip to Kerberos-only and get infinite login prompts, disable kernel-mode authentication in the application's advanced settings; that one's straight from the r/sysadmin trenches. If you run the Certificate Enrollment Web Service, it additionally needs <extendedProtectionPolicy policyEnforcement="Always"/> in its web.config; the KB has the full steps.
03 Better: remove web enrolment entirely
The community consensus at the time, and honestly still the right call where possible: if nothing needs browser-based enrolment, uninstall the role. Domain-joined enrolment (auto-enrolment, certreq, the MMC snap-ins) doesn't touch IIS at all.
Uninstall-WindowsFeature ADCS-Web-Enrollment Removes the /certsrv relay target outright. The legitimate uses are CSR submission from non-domain or non-Windows devices (BYOD, Macs, network gear), so check before you cut; if that need is real, keep the role and live with the hardening above.
04 Optional: block the EFSRPC interfaces on DCs
The pre-patch community mitigation, courtesy of Benjamin Delpy and battle-tested by r/sysadmin: Windows RPC filters that block the two EFSRPC interface UUIDs outright, so the coercion call never lands. Belt and braces alongside everything above. Save this as block-efsrpc.txt:
rpc
filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e
add filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d
add filter
quit Apply with netsh -f block-efsrpc.txt and confirm with netsh rpc filter show filter. Effective, but broad: it blocks EFSRPC for everyone, so test on one DC and watch it before rolling out, as the admins who deployed this at scale recommend. There's no native GPO for RPC filters, so deploy via SCCM or a startup script (which you'd want anyway, since they don't persist across reboots).
05 Give NTLM less room
The endgame is needing less of this guide: restrict NTLM itself. The pattern everyone who's done it successfully recommends is audit first, block second: enable "Network security: Restrict NTLM: NTLM authentication in this domain" in audit mode, watch for a week, then set "Network security: Restrict NTLM: Incoming NTLM traffic" to deny on the AD CS servers. Domain-wide NTLM removal is a project, not an afternoon: expect RDP-with-NLA, SQL Server and assorted MMC snap-ins to object (the r/sysadmin breakage catalogue is extensive), so go in with the audit data or not at all.
06 Things that don't work
Worth listing, because they circulate. Disabling the EFS service: doesn't help, because the unauthenticated endpoint lives in efslsaext.dll inside lsass, not in the EFS service; topotam's README says so outright, and all you'd do is break access to EFS-encrypted files. Setting AllowOpenRawDL to 1 to un-break backup software after patching: works, and reopens the vulnerability (0patch documented the kill switch); if a vendor tells you to do this, ask them harder questions. And SMB signing, excellent as it is, does nothing here: the relay target is HTTP, so it's EPA or nothing on that leg. (Signing does matter against relay-to-SMB attacks, so do it anyway, just not for PetitPotam.)
06 Verification
Patched and hardened? Let's prove it.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOnNewest cumulative update August 2021 or later; May 2022 or later ideally.
Get-WindowsFeature ADCS-Web-EnrollmentIf you removed the role: not installed. If you kept it, on to the next check.
On a CA keeping web enrolment:
%windir%\system32\inetsrv\appcmd list config "Default Web Site/CertSrv" -section:system.webServer/security/authentication/windowsAuthentication Expect Negotiate:Kerberos as the only provider, and the extendedProtection attributes showing Required with SSL flags. Then browse to http://your-ca/certsrv: plain HTTP should bounce you to HTTPS or refuse outright.
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\EFS' -Name AllowOpenRawDL -ErrorAction SilentlyContinue).AllowOpenRawDLExpect nothing (or 0). A 1 here means someone re-enabled the vulnerable backup path; find out who and why.
nxc smb <dc-ip> -u '' -p '' -M coerce_plusThe anonymous scan should now come back clean. For the full proof, have your pentester re-run the authenticated chain against the CA: the relay should die on EPA.
07 Rollback
The realistic rollback is web enrolment turning out to be load-bearing: the BYOD wifi onboarding flow, the Macs, the network devices submitting CSRs. If you removed the role too eagerly:
Install-WindowsFeature ADCS-Web-Enrollment Reinstalls the role; re-apply the KB5005413 hardening before calling it done. If the hardened settings broke legitimate enrolment (non-domain clients can't do Kerberos), the measured retreat is re-adding the NTLM provider on CertSrv while keeping EPA and Require SSL, then fixing the clients properly.
Rolling back the security updates themselves: don't. CVE-2021-36942 is in CISA's Known Exploited Vulnerabilities catalogue and was a ransomware staple; if an update broke something, fix forward. Same goes for the AllowOpenRawDL "fix" for backup software: that's not a rollback, that's an un-patch.
Removing the RPC filters, if you deployed them:
netsh rpc filter show filter
netsh rpc filter delete filter filterkey=<key from the listing>A restart also clears them if you're mid-test, since they don't persist across reboots.
08 References
- MSRC: CVE-2021-36942
- KB5005413 / ADV210003: Mitigating NTLM Relay Attacks on AD CS
- CERT/CC VU#405600: the partial-patch details
- SpecterOps: Certified Pre-Owned (ESC8 and friends)
- topotam/PetitPotam: the original PoC
- 0patch: what the August 2021 fix actually changed
- r/sysadmin: the PetitPotam megathread, for the field reports
If I've got anything wrong here, or you've hit an edge case I haven't covered, do say: corrections and questions are always welcome :)
Ship the fix. Prove it’s closed.
If this runbook doesn’t fit your stack, send the CVE — an operator writes a verified path, usually within a business day. Or contribute your own and get co-authored credit.