In the context of Windows Security, what is a 'null' user?

The term 'null' in this context is a technical reference to empty credentials, not a description of user capability or skill level.

A suspended account still has a defined username and password stored in the directory; it simply cannot authenticate - this is unrelated to null sessions.

A null session is established when a client connects to a Windows system's IPC$ share using an empty username and empty password, creating an unauthenticated connection. This pseudo-account allows enumeration of users, groups, shares, and other system details depending on the Windows version and configuration. It is not a real user account but rather an anonymous authentication state exploited by attackers for reconnaissance.

Null sessions are a legacy vulnerability and attack vector, not an account intentionally created for security administration purposes.