ISE compatible with Microsoft's fix for CVE-2020-1472?

[Federico Ziliotto]

Hello,

Microsoft will soon enforce a fix for CVE-2020-1472:
https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

Is ISE already comptaible with such a fix?

Thank you in advance,

Federico

[hslai]

I responded to an internal thread on 2020-Sept-12:

For ISE, I tried ISE 3.0 FCS candidate with Windows Servers 2019 updated to the latest Windows updates and not getting any of the windows events described in the MS article above. I also tried setting FullSecureChannelProtection​ to the value of 1 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters ​ and ISE 3.0 still able to authenticate.

Thus, we should be good to claim that ISE working ok with DC enforcing the use of Netlogon secure channel.