PetitPotam and NTLM Relay Attacks on AD CS: Detection and Fixes

PetitPotam is an authentication coercion technique that abuses Microsoft’s Encrypting File System Remote Protocol (MS-EFSR) to make a Windows server, including a domain controller, authenticate to a machine the attacker chooses. Relayed to an Active Directory Certificate Services (AD CS) web enrollment page that accepts NTLM without Extended Protection, that authentication becomes a certificate for the domain controller and, soon after, control of the domain. Microsoft closed the anonymous route in 2021 and 2022 but treats the relay as a configuration problem, so the chain still works for any domain user wherever AD CS keeps its old settings.

Coercion and relay to AD CS is one of the paths our Active Directory security assessment proves or rules out from one standard user account, at $6,000 for one domain with a free retest. Every internal network test covers it too, priced on our internal penetration testing cost page.

What PetitPotam is

Several MS-EFSR functions accept a file path; when it points at another host, the server connects and authenticates as its own computer account. PetitPotam, published in July 2021 by a researcher known as topotam, points that path at the attacker.

• Patching narrowed it but did not end it. CERT/CC’s vulnerability note records that the original call worked anonymously against domain controllers and calls Microsoft’s August 2021 update for CVE-2021-36942 a partial fix: any authenticated user can still coerce. In May 2022 Microsoft fixed a second anonymous coercion, CVE-2022-26925, scored 8.1 alone and 9.8 when chained with relay to AD CS.
• It is one of a family. MITRE ATT&CK files it under Forced Authentication (T1187). The Print Spooler’s “printer bug” (MS-RPRN) and DFSCoerce (MS-DFSNM) do the same job, and no patch covers every coercion method, so the fixes below target the relay.

NTLM relay attacks: the part that does the damage

An NTLM relay attack forwards an authentication in real time, giving the attacker a session on the target as the victim; nothing is cracked, so password strength is irrelevant. Our Impacket explainer covers the relay tooling.

Relay target	What the attacker gets	What stops it
AD CS web enrollment without Extended Protection (ESC8)	A certificate that authenticates as the relayed machine	HTTPS with Extended Protection set to Required, or the role removed (NTLM off is not enough: Kerberos can be relayed too)
AD CS enrollment over RPC (ESC11)	The same, through the CA’s RPC interface	CA requires encrypted RPC requests
LDAP on domain controllers	Directory writes as the relayed account, such as delegation rights	LDAP signing and channel binding
SMB on servers and workstations	A session on the host with the victim’s rights	SMB signing required

SMB-coerced authentication rarely relays to LDAP, since the client asks for signing, but web enrollment accepts it; to reach LDAP, attackers coerce over HTTP through the WebClient service.

Why AD CS turns coercion into Domain Admin (ESC8)

SpecterOps’ June 2021 paper Certified Pre-Owned named ESC8: NTLM relay to the CA’s HTTP enrollment endpoints (chiefly Certificate Authority Web Enrollment and the Certificate Enrollment Web Service). They accepted NTLM, some ran over plain HTTP, and none had relay protection on by default. PetitPotam supplied the trigger weeks later.

A domain account coerces a domain controller and relays the authentication to the enrollment page with a request for a domain controller certificate, which the CA issues because, as far as it can tell, the domain controller asked. The certificate gets a Kerberos ticket as the domain controller, whose replication rights reach every password hash in the domain, including the krbtgt key behind golden tickets.

No exploit is needed at any step, so the finding survives patching, and strong certificate mapping does not help: the certificate is issued to the right account. Our guide to Certipy and AD CS attacks covers the other escalation paths.

The PetitPotam to Domain Admin chain, step by step

Five steps, with the control that breaks each of the first two and the events that record the other three (the detection table below has the detail):

1. Coerce. A domain user calls an MS-EFSR function on a domain controller and names a host the attacker controls. The domain controller connects out and authenticates as its computer account. Broken by egress rules from Tier 0.
2. Relay. The attacker forwards that authentication to the CA’s web enrollment endpoint. Broken by Require SSL with Extended Protection set to Required.
3. Enroll. The CA issues a certificate for the domain controller’s account (events 4886 and 4887).
4. Authenticate. The certificate is exchanged for a Kerberos ticket as the domain controller, through PKINIT (event 4768 with certificate fields).
5. Replicate. With the domain controller’s replication rights, the attacker requests the domain’s password hashes (event 4662).

Steps 3 to 5 are ordinary, permitted operations once step 2 succeeds, which is why the fix belongs at the relay target.

mitm6 and other ways to capture authentication

Coercion is not the only source of relayable authentication:

• Name-resolution poisoning. LLMNR, NBT-NS and mDNS let any host answer a failed lookup; our Responder guide covers the capture and the fix.
• DHCPv6 takeover (mitm6). Windows asks for IPv6 settings over DHCPv6 even on IPv4-only networks. mitm6, released by Fox-IT in 2018, answers them, becomes the client’s DNS server and steers lookups such as WPAD to itself, so Windows authenticates to it over HTTP for relay to LDAP or AD CS.

Turn on DHCPv6 Guard and RA Guard on access switches, or block inbound DHCPv6 and router advertisements in host firewalls where IPv6 is unused, and disable proxy auto-detection. Do not simply disable IPv6: Microsoft recommends against it.

What a PetitPotam finding means for you

A successful chain, usually rated critical, exposes four gaps:

• PKI: an enrollment endpoint accepts relayed authentication, the root cause.
• Network and Tier 0: domain controllers answer coercion from user networks and connect back out, the same open paths an attacker uses for lateral movement.
• Identity: NTLM is still accepted where nothing needs it.
• Detection: if nothing alerted, a domain controller enrolling through a web page from a laptop went unseen.

Are you exposed?

The chain is open if a CA server runs Web Enrollment or the Certificate Enrollment Web Service and either Require SSL is off or Extended Protection is not set to Required. With a sensor on the CA server, Defender for Identity’s posture assessments check both; Locksmith and PSPKIAudit list enrollment endpoints but never read Extended Protection, so confirm it in IIS. ESC11 is open if the CA’s IF_ENFORCEENCRYPTICERTREQUEST flag was removed, which Locksmith also checks.

A quick self-check on each CA server, reading three settings and changing none:

1. Require SSL. In IIS Manager, open SSL Settings on each enrollment application (Web Enrollment and, if installed, the Certificate Enrollment Web Service). Require SSL should be on.
2. Extended Protection. On the same applications, open the advanced settings of Windows Authentication. Extended Protection should read Required, not Off or Accept. For the Certificate Enrollment Web Service, KB5005413 also requires the extendedProtectionPolicy value in its web.config to match (Always when the console says Required).
3. The CA’s RPC flag. Run certutil -getreg CA\InterfaceFlags on the CA; the output should list IF_ENFORCEENCRYPTICERTREQUEST, as Certipy’s ESC11 guidance describes.

If either of the first two fails on any enrollment server, treat ESC8 as open until a test shows otherwise.

How to detect PetitPotam and NTLM relay

Every stage leaves evidence, but Audit Certification Services (plus auditing in the CA’s own settings) and NTLM auditing are off by default.

Stage	Log source	Event or signal	What it means
Coercion	Network sensor reading DCE-RPC traffic	EFS RPC calls to a domain controller (DC) from a workstation	Rare in normal use; pipe access alone (5145 on lsarpc) is too noisy to alert on
Coercion	Firewall or flow logs	A DC opening SMB or HTTP to a workstation	The callback; DCs rarely connect into user subnets
Capture	Switch DHCPv6 and RA Guard logs, or a network sensor	DHCPv6 replies or router advertisements from a host that is not a router or DHCP server	A rogue DHCPv6 server (mitm6)
Relay	CA Security log	4624, logon type 3, account is a DC (ends in $), source is not that DC	A machine account logging on from where it does not live
Relay	IIS logs on the CA	Web enrollment requests by a DC account	DCs do not normally enroll through web pages
Issuance	CA Security log	4886 and 4887 for a DC or machine template	The certificate the attacker will use; record the serial
Use	DC Security log	4768 for a DC account with certificate fields populated, from another address	A ticket obtained with the relayed certificate
Replication	DC Security log	4662 with replication GUIDs, joined by Logon ID to a 4624 from a non-DC address	DCSync; the account is the DC’s own, so “account is not a DC” rules miss it
Hardening	Directory Service log	2889, 3074, 3075	Binds without signing or channel binding, to fix before you enforce

Microsoft’s signing and channel binding guidance documents the LDAP events, which need the LDAP Interface Events diagnostic level at 2; 3074 and 3075 also need channel binding at When Supported or Always. Defender for Identity has named alerts, including “Suspected PetitPotam coercion attack” and ESC8 and ESC11 certificate alerts (alert reference); several need a sensor on the CA server.

How to prevent PetitPotam and NTLM relay, in priority order

1. Fix AD CS web enrollment. If nobody uses Web Enrollment or the Certificate Enrollment Web Service, remove them. Otherwise follow Microsoft’s KB5005413: require SSL, set Extended Protection for Authentication to Required, remove NTLM from Windows Authentication on both applications and block incoming NTLM to the CA server. CERT/CC warns that EPA has no effect without Require SSL, and the Windows Server 2025 default, “When Supported”, still accepts clients that send no channel binding. Keep the CA’s IF_ENFORCEENCRYPTICERTREQUEST flag set (the default); removing it for older clients opens ESC11.
2. Enforce LDAP signing and channel binding. New Windows Server 2025 domains require signing but set channel binding only to When Supported; Windows Server 2022 and earlier enforce neither. Audit with the events above, then require signing and set channel binding to Always.
3. Require SMB signing on servers. Windows Server 2025 requires it only outbound, so set inbound signing by policy; our Active Directory hardening checklist has the settings.
4. Patch, then shrink coercion. Install the 2021 and 2022 LSA updates and the June 2025 fix for CVE-2025-33073, a reflection flaw coercion can trigger. Disable the Print Spooler on domain controllers and non-printing servers, and leave the WebClient service stopped. CERT/CC documents RPC filters that block the EFS interface remotely; test them first, since they also stop remote EFS use, such as encrypting files on a share.
5. Stop Tier 0 from calling out. Egress rules that stop domain controllers and CA servers opening SMB or HTTP into workstation subnets break the callback every coercion method needs. Network segmentation testing confirms the rules hold from each user subnet.
6. Shrink NTLM. Inventory its use in the NTLM Operational log (events 8001 to 8004), then restrict target by target, starting with the CA and domain controllers. NTLMv1 is gone from Windows Server 2025, NTLMv2 is deprecated, and Microsoft says it is preparing to disable NTLM by default.

How Invadel tests for PetitPotam and NTLM relay

On an Active Directory security assessment we start from one standard domain account, what a phished employee hands an attacker. We find every CA and enrollment endpoint, check whether each enforces Extended Protection, map coercible servers and record SMB and LDAP signing. Where the pieces line up, we prove the chain within the written rules of engagement: coercing a domain controller only with your approval, in an agreed window, with no changes to domain controllers.

Each link becomes its own finding with its fix, written up in the format our sample report shows and mapped to MITRE ATT&CK so defenders can replay the timeline against the detection map, and the free retest confirms the fixes hold. Revoke any certificates the test issues.

The assessment is $6,000 for one domain of up to a few hundred hosts, fixed in writing. The internal network penetration test adds the hosts and segmentation around the domain: $6,000 Small, $9,200 Medium, $14,500+ Large. A red team engagement from $12,500 shows whether your team catches the chain unannounced; a purple team assessment, quoted from scope, tunes these detections with your defenders. Every published price is on our pricing page.

Frequently asked questions

Are we at risk if we do not run AD CS? Less, but yes: coerced authentication can still be relayed to LDAP (if it arrives over HTTP through WebClient) or to servers without SMB signing, so signing and channel binding still matter.

Is PetitPotam the same as ESC8? No. PetitPotam is the coercion; ESC8 is the AD CS endpoint that accepts the relayed authentication and issues a certificate. Blocking MS-EFSR stops only this trigger, since the printer bug and DFSCoerce reach the same endpoint; fixing ESC8 closes it to every coercion method, though ESC11, LDAP and SMB need their own fixes.

Does disabling NTLM stop PetitPotam? It stops NTLM relay to the CA and domain controllers, but Kerberos can also be relayed to web enrollment without Extended Protection, so require HTTPS with Extended Protection set to Required. Restrict NTLM target by target after an audit; blocking it everywhere at once tends to break applications.

Will our EDR catch it? Often not: no malware runs on the CA or domain controller, so detection lives in their logs and in identity tools with a sensor on the CA.

Is PetitPotam still exploitable in 2026? Yes, for any authenticated domain user, wherever a relay target remains. Microsoft’s 2021 and 2022 updates closed the anonymous routes, and CERT/CC calls the first a partial fix because authenticated coercion still works. Windows Server 2025 ships Extended Protection on AD CS as “When Supported”, which still accepts clients that send no channel binding, so check the setting on each CA, not the operating system version.

Which CVEs are associated with PetitPotam? CVE-2021-36942 (August 2021) for the original anonymous coercion and CVE-2022-26925 (May 2022) for a second anonymous route, scored 8.1 alone and 9.8 when chained with relay to AD CS. Microsoft handles the relay itself as configuration, through KB5005413, not as a patched vulnerability.

The short version

PetitPotam makes a domain controller authenticate to an attacker, and NTLM relay turns that into an AD CS certificate and then the domain. Fix the relay targets first (HTTPS with Extended Protection or no web enrollment, LDAP and SMB signing), then shrink coercion and NTLM. Our Active Directory security assessment tests the whole chain for $6,000 per domain with a free retest (internal testing price page); scope yours here.