Detections
Analytics
2.3.10.12 Ensure 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled'
Information
When enabled, this policy setting restricts anonymous access to only those shares and pipes that are named in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymously settings. This policy setting controls null session access to shares on your computers by adding RestrictNullSessAccess with the value 1 in theHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
registry key. This registry value toggles null session shares on or off to control whether the server service restricts unauthenticated clients' access to named resources.
The recommended state for this setting is: Enabled.
Rationale:
Null sessions are a weakness that can be exploited through shares (including the default shares) on computers in your environment.
Impact:
None - this is the default behavior. If you choose to enable this setting and are supporting Windows NT 4.0 domains, you should check if any of the named pipes are required to maintain trust relationships between the domains, and then add the pipe to the Network access: Named pipes that can be accessed anonymously list:
COMNAP: SNA session access
COMNODE: SNA session access
SQL\QUERY: SQL instance access
SPOOLSS: Spooler service
LLSRPC: License Logging service
NETLOGON: Net Logon service
LSARPC: LSA access
SAMR: Remote access to SAM objects
BROWSER: Computer Browser service
Previous to the release of Windows Server 2003 with Service Pack 1 (SP1) these named pipes were allowed anonymous access by default, but with the increased hardening in Windows Server 2003 with SP1 these pipes must be explicitly added if needed.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled:Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Restrict anonymous access to Named Pipes and Shares
Default Value:
Enabled. (Anonymous access is restricted to shares and pipes listed in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymously settings.)
Additional Information:
Microsoft Windows Server 2016 Security Technical Implementation Guide:
Version 2, Release 2, Benchmark Date: May 04, 2021
Vul ID: V-225048
Rule ID: SV-225048r569186_rule
STIG ID: WN16-SO-000300
Severity: CAT II
See Also
Item Details
Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION
References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1
Plugin: Windows
Control ID: a9fa7b2f4bc16538454e8958ee3ac314fb6388f89c536828af3ce721430e7b67