Industry
Compliance
Use Cases
Cloud Security
Threat Detection
Threat Response
Playbooks
Virtual Honeypots
Security Reports
Endpoint Security
Back to All Integrations
In a Windows environment, null sessions can allow users to have anonymous access to hidden administrative shares on a system.
Once connected to the shares through a null session, attackers can potentially enumerate information about your system and environment, such as users and groups, operating systems, password policies, privileges, etc. With this information, an attacker can learn about any potential vulnerabilities or ways to best attack your systems.
Disabling null sessions is a key way to help you strengthen your organization’s security and reduce your attack surface.
Blumira makes security easy and effective for SMBs and mid-market companies, helping them detect and respond to cybersecurity threats faster to stop breaches and ransomware.
Blumira’s all-in-one SIEM platform combines logging with automated detection and response for better security outcomes and consolidated security spend.
Get your free account with Blumira and secure your Microsoft 365 environment in minutes. No credit card required.
Edit GPO- Go to Computer configuration\Policies\Windows settings\Security Settings\Local Policies\SecurityOptions
Enable:
Disable:
If you open regedit and browse to:
Figure 1: Modifying the RestrictAnonymous key in the registry
There are a wide variety of exploits for smbv1. Follow recommended settings and steps via the Microsoft Support article for your Operating System.
Sources:
Have questions or want to learn more about Blumira? We’re happy to help.
To help organizations running Microsoft environments, our guide gives you practical, step-by-step Windows tips to significantly improve your visibility into malicious activity.