312-49 · Question #340
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the…
The correct answer is A. RestrictAnonymous must be set to "2" for complete security. The Windows RestrictAnonymous registry setting has three meaningful values: 0 = no restrictions (anonymous access fully allowed), 1 = restricts enumeration of account names and shares but still permits null session establishment, and 2 = fully restricts anonymous access…
Question
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?
Options
- ARestrictAnonymous must be set to "2" for complete security
- BThere is no way to always prevent an anonymous null session from establishing
- CRestrictAnonymous must be set to "10" for complete security
- DRestrictAnonymous must be set to "3" for complete security
How the community answered
(27 responses)- A89% (24)
- B4% (1)
- D7% (2)
Explanation
The Windows RestrictAnonymous registry setting has three meaningful values: 0 = no restrictions (anonymous access fully allowed), 1 = restricts enumeration of account names and shares but still permits null session establishment, and 2 = fully restricts anonymous access, preventing null sessions entirely. Setting it to 1 provides partial protection but does not block all null session activity, which is why tools like UserInfo can still connect. Only setting it to 2 closes the null session vulnerability completely - though this may break some legacy applications that rely on anonymous access.
Topics
Community Discussion
No community discussion yet for this question.