NULL session restrictions in Windows XP SP2

• \pipe\samr, \pipe\lsarpc and \pipe\netlogon no longer hardcoded

  • Prevents all anonymous access to RPC services running inside lsass.exe (including samr and lsarpc)

• One interesting named pipe remaining: \pipe\browser

  • Can be used to reach another RPC interface running in the same svchost.exe instance, such as
    • Workstation service RPC server (wkssvc)
    • Server service RPC server (srvsvc)

• RestrictAnonymous set to 0 by default

  • When set to 1, restricts some operations of srvsvc