MS15-096: Vulnerability in Active Directory service could allow denial of service: September 8, 2015

This security update resolves a vulnerability in Active Directory Domain Services (AD DS). The vulnerability could allow denial of service if an authenticated attacker creates multiple computer accounts. To exploit this vulnerability an attacker must have valid credentials.

This security update prevents non-administrators from changing the account type on existing user and computer accounts. After you install this security update, you cannot change flags in the UserAccountControl registry entry in order to change the account type. The most frequently affected operation occurs when applications interactively or programmatically create objects in Active Directory as user accounts and then convert them to computer accounts, or vice-versa, by changing the UserAccountControl value. One mitigation is to create user or computer objects that have the intended UserAccountControl value when the object is created. For example, objects that are intended to be computer accounts should have a UserAccountControl value that contains WORKSTATION_TRUST_ACCOUNT during object creation.

The security update also prevents a computer account from creating additional computer accounts in a different domain by using the SeMachineAccountPrivilege computer account privilege. If such a scenario is required, administrators may grant explicit permissions to the cross-domain computer account on the container where the computer accounts have to be created.

To learn more about the vulnerability, see Microsoft Security Bulletin MS15-096.