Blog Post

Storage at Microsoft
11 MIN READ

SMB and Null Sessions: Why Your Pen Test is Probably Wrong

JamesKehr's avatar
JamesKehr
Icon for Microsoft rankMicrosoft
Feb 21, 2020
Hi everyone, James Kehr here with a guest post. One of the SMB cases we get regularly at Microsoft Support is, “my pen test says you allow Null sessions!” Followed by a string of CVE numbers; like, C...
Updated May 21, 2024
Version 3.0
security
DanielNiccoli's avatar
DanielNiccoli
Iron Contributor
Sep 22, 2020

Doing a 

net use \\dc1\IPC$ "" /user:

against a Server 2012 R2 domain controller returns 

The command completed successfully.

The registry values that I thought should block that are set as following:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymoussam=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\everyoneincludesanonymous=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\restrictnullsessaccess=1

Running the same command against a member server with the same registry settings returns

 

System error 5 has occurred.

Access is denied.

Could you please elaborate on that as I did not find any clue as to why a domain controller behaves differently.