RestrictAnonymous in registry keeps on returning to 0 value.

Question

VA tool keeps on detecting Allowed Null Session as vulnerability, I already set the RestrictAnonymous value to 1 in the registry but within the day the value returns to 0 I don't have a clue why. the server is stand alone so I think that this is not related to group policy issue.

Answer 1

Hello

Thank you for posting in Microsoft Community forum.

If the RestrictAnonymous value keeps returning to 0 in the registry, it is possible that there is a third-party software or script that is changing the value. You can try to identify the culprit by checking the Event Viewer for any related events or by using a tool like Process Monitor to monitor registry changes.

Additionally, you can try to set the RestrictAnonymous value through Group Policy to ensure that it is enforced. You can create a new Group Policy Object (GPO) and configure the "Network access: Restrict anonymous access to Named Pipes and Shares" policy setting under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Set the policy to "Enabled" and select the "Do not allow enumeration of SAM accounts and shares" option.

Once the GPO is created and linked to the appropriate OU, run the "gpupdate /force" command on the affected server to apply the policy immediately.

Best Regards,

Wesley Li

Answer 2

let me try that, but GPO is not suitable because it's a standalone server.

Answer 3

Okay, waiting for your test results.