|
Posted by Lognoul, Marc [Private] on January 31, 2008, 3:48 pm
Please log in for more thread options
Doing so would allow an unauthenticated user or system to "harvest" users,
groups and other security-related information.
This would ease password guessing.
I found pretty strange that an application managing password needs anonymous
access. Is this application rather old?
--
KR/Amicalement/MVG,
Marc
> Hi there,
>
> On my Windows 2003 servers I prevent anonymous sid and name
> translation, I do not allow anonymous enumeration of SAM accounts or
> shares and I do not allow the everyone permission to apply to
> anonymous users. I also do not allow any named pipes to be accessed
> anonymously.
>
> I have an application that manages passwords and in order to change
> the passwords of accounts on remote servers across the network, the
> target servers must allow anonymous access to the named pipe SAMR.
>
> Are there any serious security implications if I allow anonymous
> access to the SAMR named pipe, but keep the other restrictions in
> place?
>
> Thanks,
> Adrian.
| 
XML Sitemap