After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the…

Windows NT/2000/2003 recognize only three legal values for the HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous registry entry. 0 = No restrictions; 1 = “Do not allow enumeration of SAM accounts and shares,” but anonymous (null-session) connections to IPC$ are still permitted for some APIs. Only value 2 (“No access without explicit anonymous permissions”) blocks the creation of any null session unless the server administrator has explicitly granted the Everyone or Anonymous Logon SID access. Because you set the key to 1, the Userinfo tool could still open a null session and enumerate limited information. Setting it to 2 is the highest supported level and stops such connections.

A. “10” is not a defined value for RestrictAnonymous; Windows ignores it and treats it as 0.
B. Value 3 is unsupported; registry accepts only 0, 1, 2.
D. Blocking anonymous null sessions is possible by using value 2 and tightening share/pipe permissions.

1. Microsoft Knowledge Base KB246261 “How to restrict anonymous access in Windows 2000,” Section ‘RestrictAnonymous values 0,1,2’.

2. Microsoft Windows Server 2003 Security Guide, Ch. 5 “Securing Authentication,” pp. 99-100—discussion of RestrictAnonymous=2 eliminating null sessions.

3. National Security Agency, “Windows 2000 Security Recommendations Guide,” §4.2.1, p. 4-15—explains that value 2 prevents anonymous logons and enumeration.