A vulnerability identified as “NOTLogon” (CVE-2025-47978) has been discovered in Microsoft Corp.'s Netlogon protocol, allowing low-privilege machines to remotely crash Windows domain controllers, disrupting Active Directory services. This flaw arises from issues in the Network Ticket Logon feature introduced in late 2024, specifically in the NetrLogonSamLogonEx RPC call processing malformed inputs in the AdditionalTicket buffer. An empty or improperly formatted ticket can crash the domain controller’s LSASS process, leading to a system reboot. The vulnerability does not grant elevated privileges or allow credential theft but can cause denial-of-service attacks that halt user logins and restrict access to enterprise systems. The discovery utilized AI-assisted techniques to analyze differences in Netlogon specifications. Organizations are advised to apply the July 2025 security update, audit machine account usage, restrict machine account creation, and segment network access to protect domain controllers.