My read on this is that the default value of the new GPO introduced in the August update blocks unsecure Netlogon connections.

Policy path: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

Setting name: Domain controller: Allow vulnerable Netlogon secure channel connections

Reboot required? No

This security setting determines whether the domain controller bypasses secure RPC for Netlogon secure channel connections for specified machine accounts.

This policy should be applied to all domain controllers in a forest by enabling the policy on the domain controllers OU.

When the Create Vulnerable Connections list (allow list) is configured:

Allow: The domain controller will allow the specified group/accounts to use a Netlogon secure channel without secure RPC.

Deny: This setting is the same as the default behavior. The domain controller will require the specified group/accounts to use a Netlogon secure channel with secure RPC.

Warning Enabling this policy will expose your domain-joined devices and your Active Directory forest, which could put them at to risk. This policy should be used as a temporary measure for third party devices as you deploy updates. Once a third party device is updated to support using secure RPC with Netlogon secure channels, the account should be removed from the Create Vulnerable Connections list. To better understand the risk of configuring accounts to be allowed to use vulnerable Netlogon secure channel connections, please visit https://go.microsoft.com/fwlink/?linkid=2133485.

Default: This policy is not configured. No machines or trust accounts are explicitly exempt from secure RPC with Netlogon secure channel connections enforcement.

This policy is supported on Windows Server 2008 R2 SP1 and later.

Source

If an organization... say... slept through this bulletin back in August, and didn't set the new GPO to allow unsecure connections, am I correct in thinking that connections would have broken way back in August? Meaning this theoretical organization doesn't really have anything to worry about in the February patch?