Blog Post

Storage at Microsoft
11 MIN READ

SMB and Null Sessions: Why Your Pen Test is Probably Wrong

JamesKehr's avatar
JamesKehr
Icon for Microsoft rankMicrosoft
Feb 21, 2020
Hi everyone, James Kehr here with a guest post. One of the SMB cases we get regularly at Microsoft Support is, “my pen test says you allow Null sessions!” Followed by a string of CVE numbers; like, C...
Updated May 21, 2024
Version 3.0
security
JamesKehr's avatar
JamesKehr
Icon for Microsoft rankMicrosoft
May 16, 2022

dryara DC's are a special case when it comes to NULL sessions. AD logon requires anonymous access to the netlogon, samr, and lsarpc named pipes so users can logon. You can't authenticate to netlogon if you haven't completed logon.

 

Hardening Active Directory is outside of my area of expertise. The best I can do is point you to the official AD hardening doc.

 

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory