KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS)

Primary mitigation

We recommend enabling EPA and disabling HTTP on AD CS servers. Open the Internet Information Services (IIS) Manager and do the following:

1. Enable EPA for Certificate Authority Web Enrollment, Required being the more secure and recommended option:

   

2. Enable EPA for Certificate Enrollment Web Service, Required being the more secure and recommended option:
   
   
   
   After enabling EPA in the UI, the Web.config file created by CES role at <%windir%>\systemdata\CES\<CA Name>_CES_Kerberos\web.config should also be updated by adding <extendedProtectionPolicy> set with a value of either WhenSupported or Always depending on the Extended Protection option selected in the IIS UI above.

   Note: The Always setting is used when the UI is set to Required, which is the recommended and most secure option.

   For more information on the options available for extendedProtectionPolicy, see <transport> of <basicHttpBinding>. The most likely used settings are as follows:

   <binding name="TransportWithHeaderClientAuth">
        <security mode="Transport">
            <transport clientCredentialType="Windows">
            <extendedProtectionPolicy policyEnforcement="Always" />
            </transport>
            <message clientCredentialType="None" establishSecurityContext="false" negotiateServiceCredential="false" />
        </security>
        <readerQuotas maxStringContentLength="131072" />
   </binding>
   

3. Enable Require SSL, which will enable only HTTPS connections.
   
   

Additional mitigation

In addition to the primary mitigations, we recommend you disable NTLM authentication where possible. The following mitigations are listed in order from more secure to less secure:

• Disable NTLM Authentication on your Windows domain controller. This can be accomplished by following the documentation in Network security: Restrict NTLM: NTLM authentication in this domain.

• Disable NTLM on any AD CS Servers in your domain using the group policy Network security: Restrict NTLM: Incoming NTLM traffic. To configure this GPO, open Group Policy and go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options and set Network security: Restrict NTLM: Incoming NTLM traffic to Deny All Accounts or Deny All domain accounts.  If needed, you can add exceptions as necessary using the setting Network security: Restrict NTLM: Add server exceptions in this domain.

• Disable NTLM for Internet Information Services (IIS) on AD CS Servers in your domain running the "Certificate Authority Web Enrollment" or "Certificate Enrollment Web Service" services.

To do so open IIS Manager UI, set Windows authentication to Negotiate:Kerberos: 

For more information, please see Microsoft Security Advisory ADV210003