Anonymous Access¶
Before an attacker guesses passwords, they need usernames. Windows can hand out the account list, the share list, and more to anyone who asks over the network, with no login, if these settings are wrong.
Where¶
secpol.msc → Local Policies → Security Options. It's a long list; the names below are exact so you can find them.
The settings¶
| CIS | Setting | Set to | What it stops |
|---|---|---|---|
| 2.3.10.1 | Network access: Allow anonymous SID/Name translation | Disabled | Turning a SID into a username (the built-in Administrator's SID is well known) without logging in |
| 2.3.10.2 | Network access: Do not allow anonymous enumeration of SAM accounts | Enabled | Listing usernames without logging in |
| 2.3.10.3 | Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled | Listing usernames and share names |
| 2.3.10.4 | Network access: Do not allow storage of passwords and credentials for network authentication | Enabled | Credential Manager won't store network passwords, so they can't be dumped later |
| 2.3.10.5 | Network access: Let Everyone permissions apply to anonymous users | Disabled | Anonymous connections inheriting whatever Everyone is allowed |
| 2.3.10.6 | Network access: Named Pipes that can be accessed anonymously | (blank) | No named pipe is reachable without authentication |
| 2.3.10.7 | Network access: Remotely accessible registry paths | The default list only (System\CurrentControlSet\Control\ProductOptions, ...\Control\Server Applications, Software\Microsoft\Windows NT\CurrentVersion) |
Limits which registry keys can be read remotely |
| 2.3.10.8 | Network access: Remotely accessible registry paths and sub-paths | The default list only | Same |
| 2.3.10.9 | Network access: Restrict anonymous access to Named Pipes and Shares | Enabled | Anonymous use of the remote-management plumbing |
| 2.3.10.10 | Network access: Restrict clients allowed to make remote calls to SAM | Administrators: Remote Access: Allow | Only administrators can query the account database remotely |
| 2.3.10.11 | Network access: Shares that can be accessed anonymously | (blank) | Any share open to anonymous |
| 2.3.10.12 | Network access: Sharing and security model for local accounts | Classic - local users authenticate as themselves | The alternative ("Guest only") treats every network login as Guest, which sounds safer but means file permissions can't distinguish users |
| 2.3.1.2 | Accounts: Limit local account use of blank passwords to console logon only | Enabled | Blank-password accounts can't be used over the network |
| 2.3.7.3 | Interactive logon: Don't display last signed-in | Enabled | The login screen doesn't show the last username |
| 2.3.7.2 | Interactive logon: Don't display username at sign-in | Enabled | Same, while the password is being typed |
| STIG WN11-CC-000037 | Apply UAC restrictions to local accounts on network logons (gpedit.msc → MS Security Guide), or registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = 0 |
Enabled | A local administrator connecting over the network gets a filtered, non-admin token. This is what stops pass-the-hash with a local admin account from reaching other machines. |
For 2.3.10.7 and 2.3.10.8, an image may have added extra paths. Open the setting and compare to the defaults; remove anything added.
Step by step¶
- Open
secpol.msc→ Local Policies → Security Options. - The Network access entries sort together. Set each row.
- Accounts: Limit local account use of blank passwords is near the top. Interactive logon entries are in the middle.
Verify¶
In the secedit export, [Registry Values] section:
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSAM=1,"O:BAG:BAD:(A;;RC;;;BA)"
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares=7,
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
The 4, prefix means a number; 7, is a list; 1, is a string.
Example¶
From another machine, net view \\WORKSTATION with no credentials lists every share, and a SID-lookup tool turns SID 500 into the renamed Administrator account's new name. Set the rows above; both queries now get "Access is denied."