- August 11, 2020 updates have been deployed on all domain controllers.
- February 9, 2021 updates have been deployed on all domain controllers.
- All devices are running Windows 10.
- All devices are fully updated.
- Domain member: Digitally encrypt or sign secure channel data (always) is set to Enabled.
After the August 11, 2020 updates have been applied to DCs, events can be collected in DC event logs to determine which devices in your environment are using vulnerable Netlogon secure channel connections (referred to as non-compliant devices in this article). Monitor patched DCs for event ID 5829 events. The events will include relevant information for identifying the non-compliant devices.
Despite all of this, the following Splunk search still returns results:
index="wineventlog" sourcetype="wineventlog" EventCode IN (5827, 5828, 5829) | top limit=100 EventCode, Machine_SamAccountName | sort count DESC | table Machine_SamAccountName, EventCode, count
How can I determine if these events are false positives?