When enabled, this policy setting restricts anonymous access to only those shares and pipes that are named in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymously settings. This policy setting controls null session access to shares on your computers by adding RestrictNullSessAccess with the value 1 in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters registry key. This registry value toggles null session shares on or off to control whether the server service restricts unauthenticated clients' access to named resources. The recommended state for this setting is: Enabled. Rationale: Null sessions are a weakness that can be exploited through shares (including the default shares) on computers in your environment. Impact: None - this is the default behavior. If you choose to enable this setting and are supporting Windows NT 4.0 domains, you should check if any of the named pipes are required to maintain trust relationships between the domains, and then add the pipe to the Network access: Named pipes that can be accessed anonymously list: COMNAP: SNA session access COMNODE: SNA session access SQL\QUERY: SQL instance access SPOOLSS: Spooler service LLSRPC: License Logging service NETLOGON: Net Logon service LSARPC: LSA access SAMR: Remote access to SAM objects BROWSER: Computer Browser service Previous to the release of Windows Server 2003 with Service Pack 1 (SP1) these named pipes were allowed anonymous access by default, but with the increased hardening in Windows Server 2003 with SP1 these pipes must be explicitly added if needed.
Solution
To establish the recommended configuration, set the following Device Configuration Policy to Block: To access the Device Configuration Policy from the Intune Home page: Click Devices Click Configuration profiles Click Create profile Select the platform (Windows 10 and later) Select the profile (Endpoint protection) Click Create Enter a Name Click Next Configure the following Setting Path: Endpoint protection/Local device security options/Network access and security Setting Name: Anonymous access to Named Pipes and Shares Configuration: Block Select OK Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.) Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy. Note #2: This setting can also be created via a Custom Configuration Profile using the following OMA-URI: Name: <Enter name> Description: <Enter Description> OMA-URI: ./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares Data type: Integer Value: 1 Select OK Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.) Default Value: Enabled. (Anonymous access is restricted to shares and pipes listed in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymously settings.)