Need a use case of 'Network access: Restrict clients allowed to make remote calls to SAM'

Question

I'm trying to restrict some local admin accounts to remotely enumerate resource of on-premise domain controllers by using SAMR from workstations, which trigger alerts in MATA (yes, we still use MATA, moving to Defender for Identity) time to time.

e.g. NET USERS /DOMAIN

I read the post below and did the setup as following from a Windows 10 workstation and used gpupdate /force, logout/login, restart computer, but doesn't work.

From https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls

I wonder if I need to set it up in domain controllers, or any other setting I need to do, and if Defender for Identity can do better on this point under the Azure environment.

Thank you.

Answer 1

Hi Yao Lu,

Thank you for posting in Q&A forum.

1. May I confirm if your machine joined to domain? If the machine joined to domain, you need to go to the domain controller to set the GPO.

Put the workstations you mentioned into one OU.

Create one GPO and link this GPO to the OU above.

Edit the GPO for the setting "Network access: Restrict clients allowed to make remote calls to SAM".

If the machine did not join any domain, you just need to configure it in local group policy.

 

2. Please check if the registry key has been settled as below on your client:

Registry location HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSam

Registry type     REG_SZ

Registry value    A string that will contain the SDDL of the security descriptor to be deployed.

Possible values

• Not defined
• Defined, along with the security descriptor for users and groups who are allowed or denied to use SAMRPC to remotely access either the local SAM or Active Directory.

 

Hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

 

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.