Blog Post

Storage at Microsoft
11 MIN READ

SMB and Null Sessions: Why Your Pen Test is Probably Wrong

JamesKehr's avatar
JamesKehr
Icon for Microsoft rankMicrosoft
Feb 21, 2020
Hi everyone, James Kehr here with a guest post. One of the SMB cases we get regularly at Microsoft Support is, “my pen test says you allow Null sessions!” Followed by a string of CVE numbers; like, C...
Updated May 21, 2024
Version 3.0
security
sajid_shamir's avatar
sajid_shamir
Copper Contributor
Sep 16, 2024

Netstaff what he means null session is allowed to domain controllers and RDS server. you can configure group policy and disable null session if any on any server/pc but the policy will not be apply on Domain controllers.(i already tried). thus a hacker can use null session and get the list of users of your domain and its by design. (very great article)