Make your Win2008 more secure Limit anonymous access

Windows Server family operating system has always had a weakness. The Administrators group has high user rights. For example, remote IPC connection and terminal service login, the use of administrator account is unlimited, which is essentially different from Windows XP and Windows Vista. Today, the Vista zone will talk about how to prevent hackers from establishing IPC$ null connections, thus preventing anonymous access by remote users, opening the registry editor, locating the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA branch, and modifying RestrictAnonymous on the right. 1. 1

FIG. 1

about three cases RestrictAnonymous value interpretation:

0 Depends on the default privilege 1 does not allow enumeration of SAM accounts and name 2 can not be accessed without explicit anonymous permissions, while the Vista zone reminds you of the need to pay attention to the domain controller DC

when based on Windows 2000 When the RestrictAnonymous registry value on a domain controller in /2003/2008 is set to 2, the following tasks are restricted: A subordinate member workstation or server cannot establish a netLogon secure channel.

? Subordinate domain controllers in the trusting domain cannot establish a netLogon secure channel.

? Microsoft Windows NT users cannot change their password after the password expires. In addition, Macintosh users cannot change their passwords at all.

? The browser service cannot retrieve a list of domains or a list of servers from a backup browser, master browser, or domain master browser running on a computer with the RestrictAnonymous registry value set to 2. Therefore, all programs that rely on browser services do not work properly.

Due to the above results, it is recommended that you do not set the RestrictAnonymous registry value to 2 in a mixed mode environment that includes subordinate clients. You should consider setting the RestrictAnonymous registry value to 2 only in a Windows 2000/2003/2008 environment and only after sufficient quality assurance testing has been performed to verify that the appropriate service levels and program features continue to be maintained.