Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Apply CVE-2020-1350 (SIG-RED) Workaround for Windows DC/DNS with PowerShell
<# by diecknet
# This script is mostly based on code by reddit users /u/bernys and /u/Lanathell
# I added checks to see if DNS service is running again.
# Also see:
# -
# -
Import-Module ActiveDirectory
$AllDomainControllers = (Get-ADForest).Domains | %{ Get-ADDomainController -Filter * -Server $_ }
ForEach ($DC in $AllDomainControllers) {
$DCServer = $
write-host "Configuring DNS service on $($DCServer)" -ForegroundColor Green
Invoke-Command -ComputerName $DCServer -Command {
If ((Get-ItemProperty -Path 'HKLM:SYSTEM\CurrentControlSet\Services\DNS\Parameters' -Name 'TcpReceivePacketSize' -ErrorAction SilentlyContinue).TcpReceivePacketSize -ne '65280') {
Write-Host "Setting Registry Key on $($DCServer)" -ForegroundColor Yellow
Set-Itemproperty -path 'HKLM:SYSTEM\CurrentControlSet\Services\DNS\Parameters' -Name 'TcpReceivePacketSize' -value '65280' -Type DWord
} else {
Write-Host "Registry Key was already set on $($DCServer)" -ForegroundColor Green
Write-Host "Restarting DNS service on $($DCServer)" -ForegroundColor Yellow
Get-Service DNS -ComputerName $DCServer | Restart-Service -PassThru
Start-Sleep -Seconds 5
for($wait=1; $wait -lt 10; $wait++) {
if((Get-Service DNS -ComputerName $DCServer).Status -eq "Running") {
Write-Host "DNS service on $($DCServer) is running!" -ForegroundColor Green
Start-Sleep -Seconds 1
if((Get-Service DNS -ComputerName $DCServer).Status -ne "Running") {
Write-Host "DNS service on $($DCServer) is still not running. Please check manually!" -ForegroundColor Red
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment