Compromising an entire corporate network in about 30 minutes? In his master’s thesis, “Analyzing the Security of the Netlogon Remote Protocol,” Alexander Neff demonstrates that this is possible under certain conditions, since the patches for the “Zerologon” vulnerability in the Active Directory (AD) Netlogon protocol can be bypassed, allowing individual computer accounts or even the entire AD domain to still be compromised. For his research, he received the G DATA Study2Protect Award 2026. His thesis was supervised by Kevin Borgolte, Professor of Software Security at the Faculty of Computer Science, and Tobias Holl, doctoral candidate of the Chair.
“Zerologon” patches are not sufficient
Microsoft’s Active Directory is a central component of the IT infrastructure in many companies. It is used, for example, to centrally manage user accounts, PCs, and servers within a network, meaning that security vulnerabilities can have serious consequences for a company’s entire IT infrastructure. In 2020, a critical vulnerability known as “Zerologon” was discovered in the Netlogon remote protocol, one of the core components of the AD architecture. This vulnerability allowed attackers to completely compromise an AD administrative domain. Instead of a random combination of numbers, the initialization vector always consisted of zeros. Microsoft released two patches for “Zerologon.” However, Alexander Neff’s analysis revealed that these patches can be bypassed using “Onelogon,” a brute-force attack that, when optimized, would take about 30 minutes to execute. The prerequisite for this is a non-standard GPO configuration.
The master’s thesis served as the basis for the paper “Onelogon: Taking over Active Directory Accounts via Netlogon,” which was published and presented at USENIX WOOT 2026.
The G DATA Study2Protect Award
Innovative ideas, academic excellence, and practical solutions for the IT security of tomorrow: For the third time, the Bochum-based IT security company G DATA sought out Germany’s best bachelor’s or master’s thesis in the fields of cybersecurity, cyberdefense, and cyberresilience.
An independent panel of experts from academia, business, government agencies, and professional associations evaluated the submitted theses based on their scientific relevance, the originality of their approach, and their practical benefits for society, politics, and the economy. In the final round, the nominees presented their work in a seven-minute pitch and then spent three minutes answering questions from the jury. Particularly encouraging from Bochum’s perspective: Three of the five finalists wrote their theses at the Faculty of Computer Science or the Max Planck Institute for Security and Privacy.
“Alexander Neff’s work affects the infrastructure of nearly every company. He thoroughly examined the cryptography behind Zerologon and demonstrated that the patches released so far do not fully resolve the issue. Since a true fix would break backward compatibility, the vulnerability is difficult to address. In the end, it was this exceptional practical relevance, combined with an excellent presentation of the complex vulnerability, that made the difference,” explains Stefan Hausotte, Head of Threat Intelligence & Infrastructure at G DATA CyberDefense and jury member, regarding the final decision. In addition to the Study2Protect trophy, the winner received prize money of 1,000 euros.
General note: In case of using gender-assigning attributes we include all those who consider themselves in this gender regardless of their own biological sex.