GPEN · Question #24
Which of the following can be the countermeasures to prevent NetBIOS NULL session enumeration in Windows 2000 operating systems? Each correct answer represents a complete solution. Choose all that…
The correct answer is A. Disabling SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from C. Disabling TCP port 139/445 D. Editing the registry key HKLM\SYSTEM\CurrentControlSet\LSA and adding the value. Preventing NetBIOS NULL session enumeration requires disabling or blocking the SMB and NetBIOS transport layer services and applying registry restrictions that deny anonymous access.
Question
Which of the following can be the countermeasures to prevent NetBIOS NULL session enumeration in Windows 2000 operating systems? Each correct answer represents a complete solution. Choose all that apply.
Options
- ADisabling SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from
- BDenying all unauthorized inbound connections to TCP port 53
- CDisabling TCP port 139/445
- DEditing the registry key HKLM\SYSTEM\CurrentControlSet\LSA and adding the value
How the community answered
(45 responses)- A80% (36)
- B20% (9)
Why each option
Preventing NetBIOS NULL session enumeration requires disabling or blocking the SMB and NetBIOS transport layer services and applying registry restrictions that deny anonymous access.
Unbinding the WINS Client (TCP/IP) from the network interface disables NetBIOS over TCP/IP at the transport level, removing the protocol stack that NULL sessions rely on to establish anonymous connections.
TCP port 53 is reserved for DNS queries and zone transfers, not NetBIOS or SMB traffic, so blocking it has no effect on NULL session enumeration.
Blocking TCP ports 139 (NetBIOS Session Service) and 445 (Direct SMB) prevents the inbound connections that NULL sessions require, eliminating access at the network boundary.
Setting the RestrictAnonymous DWORD value under HKLM\SYSTEM\CurrentControlSet\Control\LSA to 1 or 2 prevents anonymous users from enumerating SAM account names and network shares, directly blocking the information disclosure that NULL sessions enable.
Concept tested: NetBIOS NULL session enumeration countermeasures
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/restrict-anonymous-access-named-pipes-shared-resources
Topics
Community Discussion
No community discussion yet for this question.