Domain privilege escalation via NTLM trust authentication

Active Directory Domain Services in Microsoft Windows before the listed fixed builds allows remote authenticated users to gain elevated domain privileges via NTLM pass-through authentication. Domain controllers accepted pass-through requests over domain or forest trusts, including requests from read-only domain controllers, without the security checks added by Microsoft. Exploitation requires valid domain credentials and reachable trust authentication; successful abuse can compromise confidentiality, integrity, and availability across the domain.