Vulnerability: shares enumerated through a null session

[Guest]

I am trying to find out if this vulnerability can be corrected for Windows XPe.

We have print device (which uses XPe as its OS) at a national laboratory.
The lab's cyber-security division performs routine scans of their network
constantly and they have issued a report for our print device regarding this
vulnerability. They were even nice enough to provide us with instructions
(for Window XP but not XPe) for correcting this within the Administrative
Tools>Local Security Policy>Security Settings>Local Policy setting. We were
to enable two items: 'Do not allow anonymous enumeration of SAM accounts' and
'Do not allow anonymous enumeration of SAM accounts and shares.'

Dutifully, we attempted to correct this. However, the setting does not exist
in the Local Security Policy for XPe.

I was wondering if there is another setting within XPe that would serve the
same purpose. Is there a means to filter ports in XPe? or can some network
component be turned off that addresses this issue without loosing TCP/IP
connectivity?

I have checked with the manufacturer and they suggested to have the labs
filter the ports at that location. However, I was hopeful that we could find
a setting in XPe which could fix this before having to resort to that.

Thanks for reading this and double-thanks for offering a solution.

Sincerely,
Marvin McKenzie

 

[JS]

Have you tried creating a custom security template?

See: How to Create a Custom Security Template

http://msdn2.microsoft.com/en-us/library/ms940857.aspx


Then in your custom template, set:
Local Policies -> Security Options -> Network Access: Do Not Allow........

 

[Guest]

No, I do not have the development tools necessary to create a custom security
template.

Thanks for your suggestion.

Marvin McKenzie

 

[Guest]

I am hoping to have some other options for consideration from this community.

Thanks again for any and all responses.

Marvin McKenzie

 

[KM]

How about just setting it via registry?
[HKLM\SYSTEM\CurrentControlSet\Control\Lsar],"RestrictAnonymous" (dword)

Regards,
KM