KB5020276—Netjoin: Domain join hardening changes

Summary

Windows updates released on and after October 11, 2022, contain additional protections introduced by CVE-2022-38042. These protections intentionally prevent domain join operations from reusing an existing computer account in the target domain unless:

• The user attempting the operation is the creator of the existing account.

  Or

• The computer was created by a member of domain administrators.

  Or

• The owner of the computer account that is being reused is a member of the "Domain controller: Allow computer account re-use during domain join." Group Policy setting. This setting requires the installation of Windows updates released on or after March 14, 2023, on ALL member computers and domain controllers.

Updates released on and after March 14, 2023 and September 12, 2023, will provide additional options for affected customers on Windows Server 2012 R2 and above and all supported clients. For more information, see the October 11, 2022 behavior and Take Action sections. 

Behavior before October 11, 2022

Before you install the October 11, 2022, or later cumulative updates, the client computer queries Active Directory for an existing account with the same name. This query occurs during domain join and computer account provisioning. If such an account exists, the client will automatically attempt to reuse it.

Note The reuse attempt will fail if the user who attempts the domain join operation does not have the appropriate write permissions. However, if the user has enough permissions the domain join will succeed.

There are two scenarios for domain join with respective default behaviors and flags as follows:

• Domain Join (NetJoinDomain)

  • Defaults to account reuse (unless NETSETUP_NO_ACCT_REUSE flag is specified)

• Account provisioning (NetProvisionComputerAccountNetCreateProvisioningPackage).

  • Defaults to NO reuse (unless NETSETUP_PROVISION_REUSE_ACCOUNT is specified.)

October 11, 2022 behavior 

Once you install the October 11, 2022, or later Windows cumulative updates on a client computer, during domain join, the client will perform additional security checks before attempting to reuse an existing computer account. Algorithm:

1. Account reuse attempt will be permitted if the user attempting the operation is the creator of the existing account.

2. Account reuse attempt will be permitted if the account was created by a member of domain administrators.

These additional security checks are done before attempting to join the computer. If the checks are successful, the rest of the join operation is subject to Active Directory permissions as before.

This change does not affect new accounts.

Note After installing the October 11, 2022, or later Windows cumulative updates, domain join with computer account reuse might intentionally fail with the following error:

Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: “An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.”

If so, the account is intentionally being protected by the new behavior.

Event ID 4101 will be triggered once the error above occurs and the issue will be logged in c:\windows\debug\netsetup.log. Please follow the steps below in Take Action to understand the failure and resolve the issue.

March 14, 2023 behavior

In the Windows updates released on or after March 14, 2023, we made a few changes to the security hardening. These changes include all the changes we made in October 11, 2022.

First, we expanded the scope of groups that are exempt from this hardening. In addition to Domain Administrators, Enterprise Administrators and Built-in Administrators groups are now exempt from the ownership check.

Second, we implemented a new Group Policy setting. Administrators can use it to specify an allow list of trusted computer account owners. The computer account will bypass the security check if one of the following is true:

• The account is owned by a user specified as a trusted owner in the “Domain controller: Allow computer account re-use during domain join” Group Policy.

• The account is owned by a user who is a member of a group specified as a trusted owner in the “Domain controller: Allow computer account re-use during domain join” Group Policy.

To use this new Group Policy, the domain controller and the member computer must consistently have the March 14, 2023, or later update installed. Some of you might have particular accounts that you use in automated computer account creation. If those accounts are safe from abuse and you trust them to create computer accounts, you can exempt them. You will still be secure against the original vulnerability mitigated by the October 11, 2022, Windows updates.

^{September 12, 2023 behavior}

In the Windows updates released on or after September 12, 2023, we made a few additional changes to the security hardening. These changes include all the changes we made in October 11, 2022, and the changes from March 14, 2023.

We addressed an issue where domain join using smart card authentication failed regardless of the policy setting. To fix this issue, we moved the remaining security checks back to the Domain Controller. Therefore, following the September 2023 security update, client machines make authenticated SAMRPC calls to the domain controller to perform security validation checks related to reusing computer accounts.

However, this may cause domain join to fail in environments where the following policy is set: Network access: Restrict clients allowed to make remote calls to SAM.  Please see the "Known Issues" section for information on how to resolve this issue.

We also plan to remove the original NetJoinLegacyAccountReuse registry setting in a future Windows update. [January 2024 - Start] This removal is tentatively scheduled for the update dated August 13, 2024. Release dates are subject to change. [End - January 2024]

Note If you deployed the NetJoinLegacyAccountReuse key on your clients and set it to value 1, you must now remove that key (or set it to 0) to benefit from the latest changes. 

Take Action

Configure the new allow list policy using the Group Policy on a domain controller and remove any legacy client-side workarounds. Then, do the following:

1. You must install the September 12, 2023 or later updates on all member computers and domain controllers. 

2. In a new or existing group policy that applies to all domain controllers, configure the settings in the steps below.

3. Under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options, double-click Domain controller: Allow computer account re-use during domain join.

4. Select Define this policy setting and <Edit Security…>.

5. Use the object picker to add users or groups of trusted computer account creators and owners to the Allow permission. (As a best practice, we highly recommend that you use groups for permissions.) Do not add the user account that performs the domain join.

   Warning: Limit membership to the policy to trusted users and service accounts. Do not add authenticated users, everyone or other large groups to this policy. Instead, add specific trusted users and service accounts to groups and add those groups to the policy.

6. Wait for the Group Policy refresh interval or run gpupdate /force on all domain controllers.

7. Verify that the HKLM\System\CCS\Control\SAM – “ComputerAccountReuseAllowList” registry key is populated with the desired SDDL. Do not manually edit the registry.

8. Attempt to join a computer that has the September 12, 2023, or later updates installed. Ensure that one of the accounts listed in the policy owns the computer account. Also ensure that its registry does not have the NetJoinLegacyAccountReuse key enabled (set to 1). If the domain join fails, check the c:\windows\debug\netsetup.log.

If you still need an alternate workaround, review computer account provisioning workflows and understand if changes are required. 

1. Perform the join operation using the same account that created the computer account in the target domain.

2. If the existing account is stale (unused), delete it before attempting to join the domain again.

3. Rename the computer and join using a different account that doesn’t already exist.

4. If the existing account is owned by a trusted security principal and an administrator wants to reuse the account, follow the guidance in the Take Action section to install the September 2023 or later Windows updates and configure an allow list.

NetpGetComputerObjectDn: Crack results: (Account already exists) DN = CN=Computer2,CN=Computers,DC=contoso,DC=com
NetpGetADObjectOwnerAttributes: Looking up attributes for machine account: CN=Computer2,CN=Computers,DC=contoso,DC=com
NetpCheckIfAccountShouldBeReused: Account was created through joinpriv and does not belong to this user. Blocking re-use of account.
NetpCheckIfAccountShouldBeReused:fReuseAllowed: FALSE, NetStatus:0x0
NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac
NetpProvisionComputerAccount: LDAP creation failed: 0xaac
ldap_unbind status: 0x0
NetpJoinCreatePackagePart: status:0xaac.
NetpJoinDomainOnDs: Function exits with status of: 0xaac
NetpJoinDomainOnDs: status of disconnecting from '\\DC1.contoso.com': 0x0
NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on 'contoso.com' returned 0x0
NetpJoinDomainOnDs: NetpResetIDNEncoding on 'contoso.com': 0x0
NetpDoDomainJoin: status: 0xaac

NetpReadAccountReuseModeFromAD: Searching '<WKGUID=AB1D30F3768811D1ADED00C04FD8D5CD,DC=contoso,DC=com>' for '(&(ObjectClass=ServiceConnectionPoint)(KeyWords=NetJoin*))'.
NetpReadAccountReuseModeFromAD: Got 0 Entries.
Returning NetStatus: 0, ADReuseMode: 0
IsLegacyAccountReuseSetInRegistry: RegQueryValueEx for 'NetJoinLegacyAccountReuse' returned Status: 0x2. 
IsLegacyAccountReuseSetInRegistry returning: 'FALSE''.
NetpDsValidateComputerAccountReuseAttempt: returning NtStatus: 0, NetStatus: 0
NetpDsValidateComputerAccountReuseAttempt: returning Result: TRUE
NetpCheckIfAccountShouldBeReused: Active Directory Policy check returned NetStatus:0x0.
NetpCheckIfAccountShouldBeReused: Account re-use attempt was permitted by Active Directory Policy.
NetpCheckIfAccountShouldBeReused:fReuseAllowed: TRUE, NetStatus:0x0

Known issues

09/18/2023 13:37:15:379 NetpDsValidateComputerAccountReuseAttempt: returning NtStatus: c0000022, NetStatus: 5
09/18/2023 13:37:15:379 NetpDsValidateComputerAccountReuseAttempt: returning Result: FALSE
09/18/2023 13:37:15:379 NetpCheckIfAccountShouldBeReused: Active Directory Policy check with SAM_DOMAIN_JOIN_POLICY_LEVEL_V2 returned NetStatus:0x5.
09/18/2023 13:37:15:379 NetpCheckIfAccountShouldBeReused:fReuseAllowed: FALSE, NetStatus:0x0
09/18/2023 13:37:15:379 NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac 
09/18/2023 13:37:15:379 NetpProvisionComputerAccount: LDAP creation failed: 0xaac

NetpGetADObjectOwnerAttributes: Looking up attributes for machine account: CN=LT-NIClientBA,CN=Computers,DC=contoso,DC=com
NetpGetADObjectOwnerAttributes: Ms-Ds-CreatorSid is empty.
NetpGetNCData: Reading NC data
NetpReadAccountReuseModeFromAD: Searching '<WKGUID=AB1D30F3768811D1ADED00C04FD8D5CD,DC=LT2k16dom,DC=com>' for '(&(ObjectClass=ServiceConnectionPoint)(KeyWords=NetJoin*))'.
NetpReadAccountReuseModeFromAD: Got 0 Entries.
Returning NetStatus: 0, ADReuseMode: 0
IsLegacyAccountReuseSetInRegistry: RegQueryValueEx for 'NetJoinLegacyAccountReuse' returned Status: 0x2. 
IsLegacyAccountReuseSetInRegistry returning: 'FALSE''.
NetpDsValidateComputerAccountReuseAttempt: returning NtStatus: c00000bb, NetStatus: 32 
NetpDsValidateComputerAccountReuseAttempt: returning Result: FALSE
NetpCheckIfAccountShouldBeReused: Active Directory Policy check returned NetStatus:0x32.
NetpCheckIfAccountShouldBeReused:fReuseAllowed: FALSE, NetStatus:0x0
NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac 
NetpProvisionComputerAccount: LDAP creation failed: 0xaac