2KKUU7ita

Figure 11-9:
Default local
security
policy settings
in
Windows 7
that restrict
null session
connections.
Chapter 11: Windows
✓ Disable File and Printer Sharing for Microsoft Networks in the Properties
tab of the machine’s network connection for those systems that don’t
need it.
✓ Restrict anonymous connections to the system. For Windows NT and
Windows 2000 systems, you can set HKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Control\LSA\RestrictAnonymous to a
DWORD value as follows:
• None: This is the default setting.
• Rely on Default Permissions (Setting 0): This setting allows the
default null session connections.
• Do Not Allow Enumeration of SAM Accounts and Shares (Setting 1):
This is the medium security level setting. This setting still allows
null sessions to be mapped to IPC$, enabling such tools as Walksam
to garner information from the system.
• No Access without Explicit Anonymous Permissions (Setting 2): This
high security setting prevents null session connections and system
enumeration.
High security creates problems for domain controller communication
and network browsing, so be careful!
Microsoft Knowledge Base Article 246261 covers the caveats of using the high
security setting for RestrictAnonymous. It’s available on the web at http://
support.microsoft.com/default.aspx?scid=KB;en-us;246261.
For later versions of Windows, such as Windows Server 2008 R2 and
Windows 7, ensure that the Network Access anonymous components of the
local or group security policy are set as shown in Figure 11-9.
213