Vulnerability: shares enumerated through a null session

I am trying to find out if this vulnerability can be corrected for Windows XPe.

We have print device (which uses XPe as its OS) at a national laboratory.
The lab's cyber-security division performs routine scans of their network
constantly and they have issued a report for our print device regarding this
vulnerability. They were even nice enough to provide us with instructions
(for Window XP but not XPe) for correcting this within the Administrative
Tools>Local Security Policy>Security Settings>Local Policy setting. We were
to enable two items: 'Do not allow anonymous enumeration of SAM accounts' and
'Do not allow anonymous enumeration of SAM accounts and shares.'

Dutifully, we attempted to correct this. However, the setting does not exist
in the Local Security Policy for XPe.

I was wondering if there is another setting within XPe that would serve the
same purpose. Is there a means to filter ports in XPe? or can some network
component be turned off that addresses this issue without loosing TCP/IP
connectivity?

I have checked with the manufacturer and they suggested to have the labs
filter the ports at that location. However, I was hopeful that we could find
a setting in XPe which could fix this before having to resort to that.

Thanks for reading this and double-thanks for offering a solution.

Sincerely,
Marvin McKenzie

Have you tried creating a custom security template?

See: How to Create a Custom Security Template

http://msdn2.microsoft.com/en-us/library/ms940857.aspx


Then in your custom template, set:
Local Policies -> Security Options -> Network Access: Do Not Allow........



"M" <M@discussions.microsoft.com> wrote in message
news:6BB9D2BF-E430-4606-855B-7581B3321F08@microsoft.com...
>I am trying to find out if this vulnerability can be corrected for Windows
>XPe.
>
> We have print device (which uses XPe as its OS) at a national laboratory.
> The lab's cyber-security division performs routine scans of their network
> constantly and they have issued a report for our print device regarding
> this
> vulnerability. They were even nice enough to provide us with instructions
> (for Window XP but not XPe) for correcting this within the Administrative
> Tools>Local Security Policy>Security Settings>Local Policy setting. We
> were
> to enable two items: 'Do not allow anonymous enumeration of SAM accounts'
> and
> 'Do not allow anonymous enumeration of SAM accounts and shares.'
>
> Dutifully, we attempted to correct this. However, the setting does not
> exist
> in the Local Security Policy for XPe.
>
> I was wondering if there is another setting within XPe that would serve
> the
> same purpose. Is there a means to filter ports in XPe? or can some network
> component be turned off that addresses this issue without loosing TCP/IP
> connectivity?
>
> I have checked with the manufacturer and they suggested to have the labs
> filter the ports at that location. However, I was hopeful that we could
> find
> a setting in XPe which could fix this before having to resort to that.
>
> Thanks for reading this and double-thanks for offering a solution.
>
> Sincerely,
> Marvin McKenzie

No, I do not have the development tools necessary to create a custom security
template.

Thanks for your suggestion.

Marvin McKenzie



"JS" wrote:

> Have you tried creating a custom security template?
>
> See: How to Create a Custom Security Template
>
> http://msdn2.microsoft.com/en-us/library/ms940857.aspx
>
>
> Then in your custom template, set:
> Local Policies -> Security Options -> Network Access: Do Not Allow........
>
>
>
> "M" <M@discussions.microsoft.com> wrote in message
> news:6BB9D2BF-E430-4606-855B-7581B3321F08@microsoft.com...
> >I am trying to find out if this vulnerability can be corrected for Windows
> >XPe.
> >
> > We have print device (which uses XPe as its OS) at a national laboratory.
> > The lab's cyber-security division performs routine scans of their network
> > constantly and they have issued a report for our print device regarding
> > this
> > vulnerability. They were even nice enough to provide us with instructions
> > (for Window XP but not XPe) for correcting this within the Administrative
> > Tools>Local Security Policy>Security Settings>Local Policy setting. We
> > were
> > to enable two items: 'Do not allow anonymous enumeration of SAM accounts'
> > and
> > 'Do not allow anonymous enumeration of SAM accounts and shares.'
> >
> > Dutifully, we attempted to correct this. However, the setting does not
> > exist
> > in the Local Security Policy for XPe.
> >
> > I was wondering if there is another setting within XPe that would serve
> > the
> > same purpose. Is there a means to filter ports in XPe? or can some network
> > component be turned off that addresses this issue without loosing TCP/IP
> > connectivity?
> >
> > I have checked with the manufacturer and they suggested to have the labs
> > filter the ports at that location. However, I was hopeful that we could
> > find
> > a setting in XPe which could fix this before having to resort to that.
> >
> > Thanks for reading this and double-thanks for offering a solution.
> >
> > Sincerely,
> > Marvin McKenzie
>
>
>

I am hoping to have some other options for consideration from this community.

Thanks again for any and all responses.

Marvin McKenzie


"M" wrote:

> I am trying to find out if this vulnerability can be corrected for Windows XPe.
>
> We have print device (which uses XPe as its OS) at a national laboratory.
> The lab's cyber-security division performs routine scans of their network
> constantly and they have issued a report for our print device regarding this
> vulnerability. They were even nice enough to provide us with instructions
> (for Window XP but not XPe) for correcting this within the Administrative
> Tools>Local Security Policy>Security Settings>Local Policy setting. We were
> to enable two items: 'Do not allow anonymous enumeration of SAM accounts' and
> 'Do not allow anonymous enumeration of SAM accounts and shares.'
>
> Dutifully, we attempted to correct this. However, the setting does not exist
> in the Local Security Policy for XPe.
>
> I was wondering if there is another setting within XPe that would serve the
> same purpose. Is there a means to filter ports in XPe? or can some network
> component be turned off that addresses this issue without loosing TCP/IP
> connectivity?
>
> I have checked with the manufacturer and they suggested to have the labs
> filter the ports at that location. However, I was hopeful that we could find
> a setting in XPe which could fix this before having to resort to that.
>
> Thanks for reading this and double-thanks for offering a solution.
>
> Sincerely,
> Marvin McKenzie

How about just setting it via registry?
[HKLM\SYSTEM\CurrentControlSet\Control\Lsar],"RestrictAnonymous" (dword)

Regards,
KM

>I am hoping to have some other options for consideration from this
>community.
>
> Thanks again for any and all responses.
>
> Marvin McKenzie
>
>
> "M" wrote:
>
>> I am trying to find out if this vulnerability can be corrected for
>> Windows XPe.
>>
>> We have print device (which uses XPe as its OS) at a national laboratory.
>> The lab's cyber-security division performs routine scans of their network
>> constantly and they have issued a report for our print device regarding
>> this
>> vulnerability. They were even nice enough to provide us with instructions
>> (for Window XP but not XPe) for correcting this within the Administrative
>> Tools>Local Security Policy>Security Settings>Local Policy setting. We
>> were
>> to enable two items: 'Do not allow anonymous enumeration of SAM accounts'
>> and
>> 'Do not allow anonymous enumeration of SAM accounts and shares.'
>>
>> Dutifully, we attempted to correct this. However, the setting does not
>> exist
>> in the Local Security Policy for XPe.
>>
>> I was wondering if there is another setting within XPe that would serve
>> the
>> same purpose. Is there a means to filter ports in XPe? or can some
>> network
>> component be turned off that addresses this issue without loosing TCP/IP
>> connectivity?
>>
>> I have checked with the manufacturer and they suggested to have the labs
>> filter the ports at that location. However, I was hopeful that we could
>> find
>> a setting in XPe which could fix this before having to resort to that.
>>
>> Thanks for reading this and double-thanks for offering a solution.
>>
>> Sincerely,
>> Marvin McKenzie