An SMB null session is an anonymous connection to a Windows file or named pipe service made without a username or password. Left permissive, it can let outsiders list accounts and shares. Block it by enabling the Windows policy that restricts anonymous access and checking the enumeration setting.
What is a null session?
SMB is the protocol Windows uses for file sharing and several remote management functions. A null session is a connection made with empty credentials. Windows has historically allowed anonymous users to do certain things, and Microsoft's documentation describes this plainly: Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares.
Microsoft documents null sessions as a weakness that can be exploited through the various shared folders on devices in your environment. The risk is information first: a list of valid account names helps an attacker guess passwords or craft social engineering. It can become access when a share or pipe grants rights to anonymous users.
Which settings control it?
Three Windows security policy settings matter most, all under Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options.
Network access: Restrict anonymous access to Named Pipes and Shares. When enabled, this restricts unauthenticated access to only the pipes and shares explicitly listed. Microsoft's page says it works by setting RestrictNullSessAccess to 1 under the LanManServer service parameters in the registry, which toggles whether the Server service restricts unauthenticated clients' access to named resources. The listed pipes and shares are held in the NullSessionPipes and NullSessionShares entries. Microsoft's best practice is to set it to Enabled, and its documentation lists the effective default as Enabled on current server, member server, client and domain controller types.
Network access: Do not allow anonymous enumeration of SAM accounts and shares. This setting governs whether anonymous connections can list account names and shares. An earlier version of Microsoft's documentation warns that without the restriction an unauthorized user could anonymously list account names and use them to attempt password guessing or social engineering. Note a documentation conflict: the current Microsoft Learn page lists the effective default as Enabled, while the older Windows 10 page lists it as Disabled. Do not rely on either. Read the effective value on your own hosts. Both pages agree that even with the policy enabled, anonymous users keep access to resources whose permissions explicitly include the built-in ANONYMOUS LOGON group, and that the setting has no impact on domain controllers.
Network access: Let Everyone permissions apply to anonymous users. Microsoft's best practice is Disabled. By default the token created for anonymous connections does not include the Everyone identity, so permissions granted to Everyone do not apply to anonymous users. Enabling it adds that identity and lets anonymous users reach anything Everyone can.
A constructed example
During a routine review, an administrator finds an old file server that was migrated from an older Windows version. Its exceptions list for anonymous shares contains a share created years ago for a scanner that was retired. The scanner is gone, the share still lists ANONYMOUS LOGON, and nobody has checked the anonymous enumeration policy. Anyone with network reach to the server can list its accounts and read that share. The administrator removes the share, enables the enumeration policy, and confirms that the exceptions list is empty. This is an invented scenario, but the combination of leftover exceptions and default settings is a typical way null session exposure persists.
How to check or apply this
- Inventory Windows hosts that run file sharing, starting with servers reachable from broad network segments.
- Check the policy "Restrict anonymous access to Named Pipes and Shares" and confirm it is Enabled. Check the RestrictNullSessAccess registry value on a few hosts to confirm what applies.
- Review the NullSessionPipes and NullSessionShares entries. They should be empty unless you can name the business reason for each entry.
- Confirm "Do not allow anonymous enumeration of SAM accounts and shares" is Enabled and that "Let Everyone permissions apply to anonymous users" is Disabled, after testing for old applications that rely on anonymous lookups.
- Search share and file permissions for ANONYMOUS LOGON and for Everyone, and remove them where not needed.
- Block SMB at network boundaries. File sharing ports should not be exposed to the internet, and segment internal networks so only the clients that need a file server can reach it.
- Apply these settings through Group Policy so new machines inherit them, and re-audit on a schedule.
- Watch authentication logs for anonymous logons to servers that should not see them.
Quick check
Is a null session the same as guest access?
No. A null session is an anonymous connection with empty credentials. Guest access is a separate account-based mechanism. Both should be controlled, but they are different settings.
Do these policies protect domain controllers?
Microsoft's documentation says the enumeration policy has no effect on domain controllers. Protect them with network segmentation and other controls.
Sources
- Microsoft Learn, Network access: Restrict anonymous access to Named Pipes and Shares
- Microsoft Learn, Network access: Do not allow anonymous enumeration of SAM accounts and shares (current)
- Microsoft Learn, same setting (Windows 10 version)
- Microsoft Learn, Network access: Let Everyone permissions apply to anonymous users
Last reviewed: 18 October 2026.
