Ins and Outs of Anonymous Access

Q: How can I control Anonymous access to my Windows XP and Windows Server 2003 platforms? What does Anonymous access mean, and how do XP and Windows 2003 make locking it down easier?

A: Anonymous access means that a user can access a Windows system or one of its resources without authenticating to a Windows security authority. A session that is established without authenticating the user on the other end is also referred to as a null session. Microsoft introduced anonymous access to allow users who don’t have Windows credentials to also access Windows-hosted resources.

In the early days, Microsoft opened too many gates for anonymous users—giving way to many (in)famous security exploits. On Windows NT 4.0 and Windows 2000 for example, it's trivial for anonymous users to enumerate all accounts defined on a system and to retrieve the names and security identifiers of key accounts, such as the default administrator account. In XP, Windows 2003 and Windows 2003 R2, Microsoft more effectively restricts what can be done to a Windows system and its resources when they are accessed anonymously. To further lock down Anonymous access, Microsoft added a couple of new registry keys and locked down certain configuration settings that before were wide open.

A key security enhancement in Windows 2003 is that the privileges of the Everyone group no longer automatically apply to anonymous users. In earlier Windows versions, the Everyone group was automatically added to the access token of the anonymous user account; hence anonymous users automatically received all privileges of the Everyone group. This behavior can be controlled using the following Group Policy Object (GPO) setting: “Network access: Let Everyone permissions apply to anonymous users.” This setting is located in the Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options GPO container. It corresponds to the following registry key: HKEY_LOCAL_MACHINESystemCurrentControlSetControlLSAeveryoneincludesanonymous.

All anonymous access–related GPO security options, their default and recommended settings, and their meanings are listed in Table 1. All settings can be found in the Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options GPO container. Table 1 lists only the Anonymous access-related GPO security options for Windows 2003, R2 and XP. Win2K, NT 4.0, and earlier Windows versions are not covered.

In XP, Windows 2003, and R2 most of these settings are enabled by default. The only Anonymous access-related GPO settings I recommend that you change are:

Changing some of these settings can have interesting side-effects. Use these settings with extreme care and make sure that you apply changes first in a test environment before using them in your production network. For an overview of things that may not work if you change some of the settings listed in Table 1, have a look at the Microsoft article " Client, service, and program incompatibilities that may occur when you modify security settings and user rights assignments" at http://support.microsoft.com/kb/823659. Most of the problems that may occur are related to the operation of machines that are running older Windows versions.

A last recommendation in the context of this discussion on restricting Anonymous access is related to the built-in “Pre-Windows 2000 Compatible Access” Active Directory (AD) domain local group. If during AD installation (dcpromo) you select “Permissions compatible with pre-Windows 2000 server operating systems” (as Figure 1 shows), this group will include the anonymous logon security principal. By default, the Pre-Windows 2000 Compatible Access group has the permissions to see all AD objects and all properties of AD user and group objects. In other words: thanks to the default memberships of this group anonymous users can perform AD data enumeration. That's why in Windows 2003 environments, where you don't need this group for compatibility with NT servers, I recommend you remove the anonymous logon account from the Pre-Windows 2000 Compatible Access group. You can do this by changing the group’s membership from the Microsoft Management Console (MMC) AD Users and Computers snap-in or from the command line as follows:

Net localgroup “Pre-Windows 2000 Compatible Access” “Anonymous Logon” /deleteThe NT RAS server is an example of a server that requires Anonymous access to AD and thus anonymous membership of the “Pre-Windows 2000 Compatible Access” group. See the following Microsoft article " How To Add Users to the Pre-Windows 2000 Compatible Access Group in Windows Server 2003" at http://support.microsoft.com/kb/325363/en-us for more information.

Table 1: Anonymous access-related Security Options in the GPO settings