Can We disable Lanmanserver service in order to avoid the Null sesssions in ONE Domain controller ?

Question

Hi There,

In the production environment, in order to avoid the potential attack using null session in servers, can we disable Lanmanserver services in one Domain Controller?

As we can see the netlogon services rely on this services in one DC.

Can we disable it?

Answer 1

Hi,

Thank you for your question and reaching out.

I understand that you want to know if you can disable Lanmanserver services in one Domain Controller. You're not able to just "disable" the domain services on it. Windows does not also recommend doing so. However, if you're sure disabling it would improve avoiding potential attack in your servers, you may disable it using the PowerShell command below:

Start-Process powershell -ArgumentList '-noprofile -file C:\Scripts\StopLanManServerService.ps1' -verb RunAs

or this command instead:

net stop lanmanserver /y

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

You can follow along here for hardening steps.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/securing-domain-controllers-against-attack

--please don't forget to upvote and Accept as answer if the reply is helpful--