1

Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB

Since The Processes running Under Local System Account do not have Username/Password so they used unauthenticated Null session during SMB authentication to access remote computer in earlier versions of windows, Does a process running under Local System Still use unauthenticated SMB session to access remote network in recent version of windows ?

When Windows boots it creates several logon sessions like NT Authority/Local System, Nt Authority /Local Service, NT Authority /Network Service etc. including NT Authority /Anonymous Logon used for unauthenticated SMB Null session Locally or Remotely. My second question is it Theoretically/Practically Possible to Logout of this session ( NTAuthority /Anonymous Logon) and later login, what security risks can it present in windows Platform

Using Logonsessions a tool from sysinternals we can see these Logon sessions, Here we can see Ananymous Logon Session Used for unauthenticated SMB connection in Windows server 2003

Logon session 00000000:0000e0cc:
User name:    NT AUTHORITY\ANONYMOUS LOGON
Auth package: NTLM
Logon type:   Network
Session:      0
Sid:          S-1-5-7
Logon time:   13/04/2015 03:49:39
Logon server:
DNS Domain:

To be more specific there are only two questions here:

  1. Can a processes running under local system account in windows 8.1 trying to access a Local/Remote network resource can still use Null session during SMB authentication?

  2. Can we logout of NT Authority /Anonymous Logon session that starts when windows boots and is session used for anonymous/null session and if possible what security risks it presents to recent windows platform ?

closed as unclear what you're asking by ThoriumBR, Mark, schroeder, Eric G, Xander Apr 14 '15 at 0:08

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Could you make your specific question a bit clearer? – RoraΖ Apr 13 '15 at 17:48
  • The question you are asking appears to be missing. – zedman9991 Apr 13 '15 at 17:48
  • The Question is Simple First Does a process running under Local System Still Use Null Session During SMB Authentication in recent version of windows, Second is it possible to logout of (NT Authority /Anonymous Logon) session that starts when windows boots and security risks – raven Apr 14 '15 at 4:52
  • @raven I've read your question a number of times, and am familiar with Windows networking and SMB, but still don't understand what you're asking. You've mentioned null sessions a bunch of times, and asked if Windows still "uses them" (which in itself is vague - does it use them for what?), but you haven't been clear about what specific security question you have. Feel free to edit your question (there's an edit button underneath it) to clarify exactly what you're asking. – Polynomial Apr 14 '15 at 9:41
  • @raven You should keep in mind that StackExchange has very specific question quality requirements, to avoid large numbers of poor questions and answers which drown out the quality content. Don't take it personally. – Polynomial Apr 14 '15 at 9:54

Browse other questions tagged or ask your own question.