Detections
Analytics

1.234 WN19-SO-000270

Information

Windows Server 2019 must prevent NTLM from falling back to a Null session.

GROUP ID:V-205917
RULE ID:SV-205917r991589

NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.

Solution

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> 'Network security: Allow LocalSystem NULL session fallback' to 'Disabled'.

See Also

https://workbench.cisecurity.org/benchmarks/22176

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-205917r991589_rule, STIG-ID|WN19-SO-000270

Plugin: Windows

Control ID: 1ada3d543ab7c39e7272c2f01edcb7b38fb18c96d32cc6397c88890f5734fd36