How a NULL session can fail?

• SMB-related ports (445/tcp, 139/tcp) filtered or disabled

  • IP filtering, Server service not bound to the network adapter, ...

• Server service refusing unauthenticated SMB sessions

  • Only theoretical, never happens in practice

• IPC$ share disabled

  • Before Windows XP, IPC$ might be deleted (net share IPC$ /delete)

• Named pipe can not be opened anonymously

  • XP SP2, W2K3 SP1: named pipe might be forbidden, even for authenticated sessions (named pipe firewall)

• DCE-RPC server refusing unauthenticated bind requests

• Individual operations inside a DCE-RPC interface implementing access control