NULL session restrictions in Windows 2003

• 6 hardcoded named pipes

• Anonymous access to samr forbidden

  • RestrictAnonymousSam registry value set to 1 by default

• Anonymous access to lsarpc forbidden

  • Default setting for a Windows 2003 system
  • Can be allowed by adding and setting TurnOffAnonymousBlock to 1
  • In addition, the security option Network access: Allow anonymous SID/Name translation is disabled by default

• Anonymous access to wkssvc and srvsvc allowed

  • RestrictAnonymous set to 0 by default
  • If set to 1, some additional restrictions for srvsvc operations