Title

Anonymous enumeration of shares will be restricted. (Cat I impact)

Discussion

This is a Category 1 finding because it allows anonymous logon users (null session connections) to list all account names and enumerate all shared resources, thus, providing a map of potential points to attack the system. By default, Windows allows anonymous users to list account names and enumerate share names.

Check Content

Fix Text

Configure the policy values for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network access: Do not allow anonymous enumeration of SAM accounts and shares” to “Enabled".

Additional Identifiers

Rule ID: SV-25090r1_rule

Vulnerability ID: V-1093

Group Title: Anonymous shares are not restricted

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.