My Name is Nobody: The NULL session is not necessarily evil

This may be Terence Hill’s best movie (well “less worst actually”) and it can turn out to be something useful in some scenarios. NULL session I mean

Example:

• You’re setting up a Windows deployment infrastructure but you want to be able to fetch software from a repository located on a server while your system is not joined to a domain yet
• You could use FTP or HTTP but you’d prefer to use an UNC path like \\MYSERVER\Software
• By default, you’ll then have to prove credentials in order to connect to this shared folder
• If you want to automate the download and installation of those software’s, these credentials must be placed into your automation script
• …Therefore exposing your systems a little too much since the credentials can be re-used to logon interactively, or, if it is a domain account, to list 90% of your AD…

There is an alternative to this: creating a share accessible anonymously. Here’s how to proceed:

1. On you file server, create a folder named “Software” then share this folder, preferably keeping hit “hidden” by naming it Software$
2. Add the following permissions at share-level: Anonymous Logon: Read
3. Add the following permissions at NTFS-level: Anonymous Logon: Read & Execute, List folder contents, Read
4. Edit the server’s security policy by typing secpol.msc
5. Navigate to Security Settings > Local Policies > User Right Assignment
6. Grant the right “Access this computer from the network” to “Anonymous Logon” and accept the warning
7. Navigate to Security Settings > Local Policies > Security Options. For the option “Network access: Shares that can be accessed anonymously”, add Software$ to the list.
8. Close the console and execute the command gpupdate /force
9. The system is now ready
10. From a system located in a workgroup, test the following command: net use * \\MYSERVERSoftware$ /u:”” “”. This should map a free network drive to the share and granting read access.
11. Optionally, you can audit logon/logoff on MYSERVER, the event generated as consequence of the net use command will not contain any username but it will contain the clientcomputer name and its IP address as well.

And cut!