Title

Anonymous shares are not restricted. (Cat I impact)

Discussion

This is a Category 1 finding because it allows anonymous logon users (null session connections) to list all account names and enumerate all shared resources, thus providing a map of potential points to attack the system. By default, Windows allows anonymous users to list account names and enumerate share names.

Check Content

Fix Text

Configure the policy values for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Do not allow anonymous enumeration of SAM accounts” and “Network access: Do not allow anonymous enumeration of SAM accounts and shares” to “Enabled".

Additional Identifiers

Rule ID: SV-28981r1_rule

Vulnerability ID: V-1093

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.