Zerologon Assessment Report Template
Assessment Details
| Field |
Value |
| CVE |
CVE-2020-1472 |
| CVSS |
10.0 Critical |
| Assessment Date |
YYYY-MM-DD |
| Target DCs |
[List of DCs tested] |
| Assessor |
[Name] |
Findings
Domain Controller Patch Status
| DC |
IP |
OS |
Patched |
Enforcement Mode |
Exploitable |
| DC01 |
X.X.X.X |
Server 2019 |
Yes/No |
Yes/No |
Yes/No |
| DC02 |
X.X.X.X |
Server 2022 |
Yes/No |
Yes/No |
Yes/No |
Exploitation Result
| Step |
Result |
Timestamp |
| Vulnerability Check |
Vulnerable/Patched |
HH:MM:SS |
| Machine Account Reset |
Success/Fail |
HH:MM:SS |
| DCSync |
Success/Fail |
HH:MM:SS |
| Password Restoration |
Success/Fail |
HH:MM:SS |
Impact Assessment
- Domain Compromise: Full / Partial / None
- Credentials Extracted: XX hashes
- Persistence Achieved: Yes / No
- AD Services Disrupted: Yes / No (and duration)
Remediation
Immediate
- Apply KB4571694 on all unpatched DCs
- Enable Netlogon enforcement mode
- Verify AD replication health
Long-Term
- Implement network segmentation for DC access
- Deploy Microsoft Defender for Identity
- Monitor Event ID 5805 continuously
