Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB
Since The Processes running Under Local System Account do not have Username/Password so they used unauthenticated Null session during SMB authentication to access remote computer in earlier versions of windows, Does a process running under Local System Still use unauthenticated SMB session to access remote network in recent version of windows ?
When Windows boots it creates several logon sessions like NT Authority/Local System, Nt Authority /Local Service, NT Authority /Network Service etc. including NT Authority /Anonymous Logon used for unauthenticated SMB Null session Locally or Remotely. My second question is it Theoretically/Practically Possible to Logout of this session ( NTAuthority /Anonymous Logon) and later login, what security risks can it present in windows Platform
Using Logonsessions a tool from sysinternals we can see these Logon sessions, Here we can see Ananymous Logon Session Used for unauthenticated SMB connection in Windows server 2003
Logon session 00000000:0000e0cc: User name: NT AUTHORITY\ANONYMOUS LOGON Auth package: NTLM Logon type: Network Session: 0 Sid: S-1-5-7 Logon time: 13/04/2015 03:49:39 Logon server: DNS Domain:
To be more specific there are only two questions here:
Can a processes running under local system account in windows 8.1 trying to access a Local/Remote network resource can still use Null session during SMB authentication?
Can we logout of NT Authority /Anonymous Logon session that starts when windows boots and is session used for anonymous/null session and if possible what security risks it presents to recent windows platform ?