Forced Authentication (Coercion)

Also calledCoerced authentication, PetitPotam, DFSCoerce, Printer bug

Makes a server, a DC included, sign in to a machine the attacker controls.

Needs
Domain Account
Gives
Incoming Sign-In

How the Attack Works

Some remote calls take the name of a machine, or a path on one, and make the server connect to it, among them print change notifications (MS-RPRN), the encrypting file system (MS-EFSR) and DFS namespace management (MS-DFSNM). The server, a domain controller included, then signs in to that machine as its own computer account, over SMB or, where the WebClient service runs, HTTP. Named by its address, which has no SPN, that machine gets an NTLM sign-in that can be relayed. A server trusted for unconstrained delegation gets a Kerberos sign-in that hands it the DC's own TGT.

Read first NTLM Negotiate, Kerberos Delegation

How It Plays Out

The attack step by step. Each step shows which machines take part, what travels, the keys and tickets each side now holds, what is logged and what a defender can see.

A foothold on ws-017, dana's workstation, makes dc-01 sign in to it, then passes that sign-in on to srv-fin-01.Step through it

ws-017 Foothold

dc-01 Domain controller

  • krbtgt key
  • Netlogon key

srv-fin-01 File server

  • srv-fin-01 key
  • Netlogon key
  1. Step 1 of 3, Callback Request, ws-017 to dc-01
  2. Step 2 of 3, Forced Sign-In, dc-01 to ws-017
  3. Step 3 of 3, Passed on, ws-017 to srv-fin-01

  1. Step 1 of 3: Callback Request

    ws-017 Foothold to dc-01 Domain controller

    Request that makes the DC call back RPC request (MS-RPRN, MS-EFSR or MS-DFSNM) RPC over SMB, port 445

    WS-017$ calls dc-01 over a named pipe with a print, file encryption or DFS request that names ws-017 by its address.

    What Defenders See

    Where Detailed File Share auditing is on, the Security log on dc-01 shows event 5145 for the spoolss, efsrpc or netdfs pipe from 192.0.2.17. Defender for Identity also raises its coercion alerts.

  2. Step 2 of 3: Forced Sign-In

    dc-01 Domain controller to ws-017 Foothold

    Forced sign-in from the DC NEGOTIATE_MESSAGE SMB, port 445, or HTTP

    dc-01 connects to the address it was given and, as an address has no SPN, starts an NTLM sign-in to ws-017 as DC-01$.

    What Defenders See

    Endpoint network data shows dc-01, a domain controller, opening SMB or HTTP to ws-017, a workstation. Where NTLM auditing is on, look for event 8001 or 4020 in the Microsoft-Windows-NTLM/Operational log on dc-01.

    Hooks into NTLM negotiate

  3. Step 3 of 3: Passed on

    ws-017 Foothold to srv-fin-01 File server

    The DC's sign-in, passed on NEGOTIATE_MESSAGE SMB, port 445

    ws-017 passes dc-01's sign-in on to srv-fin-01, message by message, as NTLM relay describes.

    What Defenders See

    The Security log on srv-fin-01 shows event 4624 for DC-01$ from 192.0.2.17 with Workstation Name DC-01, which is a DC signing in from a workstation's address.

Needs First

What the attacker must already hold for this attack to be possible.

  • A Domain AccountAny domain account, to make the remote call that names the target.

Comes From

Gives the Attacker

What running it hands the attacker to use next.

  • An Incoming Sign-InA server's own sign-in, a DC's included, arriving at a machine the attacker controls.

Leads To

What Defenders See

What this attack leaves for a defender to find, and what to read in each. None of it is proof on its own, so treat each as a lead and confirm it against the rest.

Event and LogWritten OnLook ForSwitch It On
5145 A network share object was checked to see whether client can be granted desired access (opens in a new tab) Security logThe server that holds the share, named pipes on IPC$ includedOn a DC, the spoolss, efsrpc or netdfs pipe opened from a workstation, where Audit Detailed File Share is on.Audit Detailed File Share
4624 An account was successfully logged on (opens in a new tab) Security logThe computer that was logged on toOn the server the sign-in was passed to, a logon as DC-01$ from a workstation's Source Network Address.Reading Logon Events explains how to read it.Audit Logon
8001 NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked (opens in a new tab) Microsoft-Windows-NTLM/Operational logThe client that sends the NTLM sign-inOn a DC, an outgoing NTLM sign-in to a workstation, where outgoing NTLM is audited.Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers, set to Audit all
4020 and 4021 This machine attempted to authenticate to a remote resource via NTLM (opens in a new tab) Microsoft-Windows-NTLM/Operational logThe client that sends the NTLM sign-in (4021 flags a weaker one, such as NTLMv1)On a DC with enhanced NTLM logging, an NTLM sign-in whose Target Machine is a workstation.On by default on Windows 11 24H2, Windows Server 2025 and, with October 2026 updates, Windows Server 2019 and 2022. The NTLM Enhanced Logging policy (System > NTLM) controls it

What It Looks Like

One event from the worked example, decoded field by field, so you can see what to read in it and what each value means.

5145 A network share object was checked to see whether client can be granted desired access

In the Security log on dc-01,

A workstation's computer account opens the Print Spooler's pipe on dc-01.

  • The caller, ws-017's computer account, the identity SYSTEM and network services use there. A workstation has no reason to call a DC's print service.

    As Windows writes it: Account Name WS-017$

  • ws-017. Look in dc-01's outgoing connections just after this moment for one back to this address.

    As Windows writes it: Source Address 192.0.2.17

  • The share named pipes live on, which is the way remote calls reach a server over SMB.

    As Windows writes it: Share Name \\*\IPC$

  • The Print Spooler's pipe (MS-RPRN). With the spooler stopped on DCs, the call has nothing to reach.

    As Windows writes it: Relative Target Name spoolss

Defender for Identity Alerts

Where Defender for Identity runs, its sensors raise these from what they read on the servers they are installed on, domain controllers above all. Each names what it flags, which is a lead to confirm, not proof on its own.

Blind Spots

Where this attack leaves little or nothing to see, so a quiet log is not read as an all-clear.

  • Detailed File Share auditing is very noisy on a DC, and file encryption calls can also arrive on lsarpc, the pipe domain members use for name and SID lookups.
  • The Kerberos form uses no NTLM at all, so watch servers trusted for unconstrained delegation for sign-ins by domain controllers.

Look for It on a Machine

The Registry keys on an endpoint that hold a trace of this, each opening its own page.

Hunt It

The query to run in each tool, and how well each one sees this attack. Pick the tool you use, and the others load their query when you open them.

Sees It DirectlyDeviceNetworkEvents (documentation, opens in a new tab)

Needs Defender for Endpoint on the domain controllers, with Servers and the DC name pattern set to your own. A hit is a DC connecting out, not proof that a call forced it. Defender for Identity's coercion alerts name the call behind it.

KQLDefender XDR, Advanced hunting
// Domain controllers opening SMB or web connections to internal machines that are not serverslet Servers = dynamic(["192.0.2.10", "192.0.2.11", "192.0.2.15", "192.0.2.20", "192.0.2.25"]);DeviceNetworkEvents| where Timestamp > ago(30d)| where DeviceName startswith "dc-"| where ActionType == "ConnectionSuccess" and RemotePort in (445, 80)| where RemoteIPType !in ("Public", "Loopback") and RemoteIP !in (Servers)| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName| order by Timestamp desc

How to Prevent It

The controls that break this attack, each with how it helps here and, where the Registry topic has it, where to check it on a machine.

Attacks tied to this one that its needs and gives do not already name, such as another form of it or its reverse, each with how the two connect.

  • Kerberos Delegation Abuse

    In the Kerberos form, a DC forced to sign in to a server trusted for unconstrained delegation hands it a TGT.

Sources