Hardened UNC CVE-2015-0008 fix

Modified on Fri, 14 Aug at 10:41 AM

Overview

This executable enables mutual authentication and integrity requirements for the NETLOGON and SYSVOL UNC paths used by Windows domain environments.

Hardened UNC Paths Configuration

CVE-2015-0008 / MS15-011

Executable: hardened_unc_CVE-2015-0008_fix.exe

Solution

1. Access the Device

Log in to the Windows device where the mitigation needs to be applied.
Ensure that you have the required Administrator privileges.

2. Configure the Hardened UNC Paths

The executable configures the following registry key:

Registry key: HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths

The following UNC paths are configured:

\*\NETLOGON:
- RequireMutualAuthentication=1
- RequireIntegrity=1
\*\SYSVOL:
- RequireMutualAuthentication=1
- RequireIntegrity=1

3. Configure the Registry View

The executable uses the following registry view:

On 64-bit Windows, it uses the 64-bit registry view.
On other systems, it writes to the default registry view.

4. Apply the Configuration

The executable runs silently and creates or updates the HardenedPaths policy entries for the NETLOGON and SYSVOL shares.

The resulting configuration is:

Registry key: HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths 
\\*\NETLOGON: RequireMutualAuthentication=1, RequireIntegrity=1 
\\*\SYSVOL: RequireMutualAuthentication=1, RequireIntegrity=1

5. Verify the Configuration

Verify that the following registry configuration is present:

Registry key: HKLM\Software\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths
\*\NETLOGON: RequireMutualAuthentication=1, RequireIntegrity=1
\*\SYSVOL: RequireMutualAuthentication=1, RequireIntegrity=1

What the Executable Does

The executable runs silently and creates or updates the HardenedPaths policy entries for the NETLOGON and SYSVOL shares.

References

Microsoft MS15-011: Group Policy vulnerability and Hardened UNC Paths:

https://support.microsoft.com/en-us/servicing/os/windows/2015/02/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-execution-february-10-2015

Microsoft Security Update Guide: CVE-2015-0008:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2015-0008