Restrict Named Pipes and Null Sessions via Regedit

Anonymous access through null sessions and named pipes allows unauthenticated users to establish connections to a Windows machine, potentially exposing system information, user lists, and network shares to malicious actors. This article provides a direct guide for system administrators to secure Windows systems by modifying the Windows Registry (regedit) to disable null session shares, restrict named pipe access, and block anonymous enumeration.

1. Configure LanmanServer Parameters

To restrict anonymous access to named pipes and network shares, navigate to the LanmanServer registry key:

  1. Press Win + R, type regedit, and press Enter.

  2. Navigate to the following path:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

  3. Modify or create the following values:

    • RestrictNullSessAccess
      • Type: REG_DWORD
      • Value: 1
      • Purpose: Ensures that unauthenticated users cannot access system pipes or shares.
    • NullSessionPipes
      • Type: REG_MULTI_SZ
      • Value: Clear all contents or delete unnecessary named pipe entries (e.g., leave blank to restrict all anonymous named pipe connections).
    • NullSessionShares
      • Type: REG_MULTI_SZ
      • Value: Clear all contents (leave blank to prevent anonymous access to any shared folders).

2. Configure Local Security Authority (LSA) Settings

Additional registry modifications under the LSA subkey prevent anonymous users from enumerating Security Account Manager (SAM) accounts and network shares:

  1. In the Registry Editor, navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  2. Modify or create the following values:

    • RestrictAnonymous
      • Type: REG_DWORD
      • Value: 1 (Restricts enumeration of SAM accounts and shares) or 2 (Strictly restricts access without explicit anonymous permissions; note that 2 may impact legacy domain applications).
    • RestrictAnonymousSAM
      • Type: REG_DWORD
      • Value: 1
      • Purpose: Explicitly denies anonymous users permissions to enumerate SAM accounts and names.
    • EveryoneIncludesAnonymous
      • Type: REG_DWORD
      • Value: 0
      • Purpose: Ensures permissions granted to the “Everyone” group do not automatically apply to anonymous connections.

3. Apply the Changes

Registry changes to the LanmanServer and Lsa keys require a service or system restart to take effect: