Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide

The Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (V3 R7) has 364 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

364STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R7

CurrentPublished Thu Nov 09 2023

Network shares that can be accessed anonymously must not be allowed.

Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide

Assessment Title

Rule Text

Network shares that can be accessed anonymously must not be allowed.

Description

Discussion Text

Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-226322

Rule

SV-226322r794549_rule

Severity

high

Rule Version

WN12-SO-000059

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the following registry value does not exist, this is not a finding:

If the following registry value does exist and is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\

Value Name: NullSessionShares

Value Type: REG_MULTI_SZ
Value: (Blank)

Implementation Procedure

Fix Text

Ensure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Shares that can be accessed anonymously" contains no entries (blank).

STIG check 286 of 364 in the Microsoft Windows Server 2012/2012 R2 Domain Controller STIG checklist

← Previous · V-226321Anonymous access to Named Pipes and Shares must be restricted.Next · V-226323 →The system must be configured to use the Classic security model.