4.7.5. Restrictions on named pipes (IPC$ share)

The NullSessionPipes registry value is supposed to configure the list of named pipes that can be opened anonymously:
Key: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
Value: NullSessionPipes (REG_SZ)

On default Windows NT 4.0 systems, the list of named pipes is:

Key: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
Value: NullSessionPipes (REG_SZ)
Default value: COMNAP COMNODE SQL\QUERY SPOOLSS LLSRPC EPMAPPER LOCATOR WINREG

On default Windows 2000 systems, there are two more named pipes (TrkWks and TrkSvr, opened by the Distributed Link Tracking Client and Distributed Link Tracking Server services):

Key: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
Value: NullSessionPipes (REG_SZ)
Default value: COMNAP COMNODE SQL\QUERY SPOOLSS LLSRPC EPMAPPER LOCATOR TrkWks TrkSvr

In Windows 2000 Service Pack 4 (SP4), the LLSRPC named pipe was removed, as documented by Microsoft [45]. Note however that LLSRPC is removed only when SP4 is installed on an existing Windows 2000 installation, but NOT when SP4 is slipstreamed to create a Windows 2000 SP4 installation image.

Starting with Windows XP, this registry value can be set via a security option:

Network access: Pipes that can be accessed anonymously