This post was most recently updated on December 11th, 2018
Null session share
Aanmaken onder Windows 2000/2003
Maak op de reguliere manier een share aan. Het is aan te raden, gezien te toegangsrechten, om hier te kiezen voor een hidden share (dollar share).
Stel de volgende share rechten in:
Client computers (which run as the SYSTEM user) to access the computer hosting the shared files. If the shared files are on a computer with the NTFS file system, you will also need to make sure that “EVERYONE”, “NETWORK”, or “ANONYMOUS LOGON” has NTFS “read” permissions.
To set up a null session share on an NT-based machine:
On the computer that you are using to host the files, share the folder with the administrative installation point or the Office CD and remember its share name. (Make sure “Everyone” or “Authenticated Users” has full permissions on the share.)
From the Start menu, Run the program “regedt32“.
In the Registry Editor window, find the “HKEY_LOCAL_MACHINE on Local Machine” window.
Navigate to “HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/lanmanserver/parameters.”
Open the multi string value “NullSessionShares” and add the share name from the folder you selected in step 1. This value should be entered on a new line in the registry value.
Close the Registry Editor window.
Under Administrative Tools, select Services.
Right-click on the “Server” service and select Restart to restart the service.
Note:
- Start menu
- Run
- gpedit.msc
- Drill down to the following location:Local Computer Policy\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
- Double click on “Network access: Let Everyone permissions apply to anonymous users”
- Select “Enable” and press Enter
To test your setup, you can use the “net use” command to connect to your resource using an anonymous login and null password (simulating what the BES Client process will be doing). From a command prompt, execute the following:
net use \\\\servername\\sharename “” /user:””
where \\\\servername\\sharename is replaced by the UNC of the null share.
Note: if you already have a connection to the server, you will have to clear the connection to the server prior to executing the above command, or it will instead attempt to map the device using the previously successful connection parameters.
The response “The command completed successfully” indicates that the device was mapped successfully, while errors such as “System error 5 has occurred. Access is denied” indicate an immediate failure and you must verify your setup.
If you have successfully mapped the device, you should then attempt to copy files to or from the resource “\\\\servername\\sharename” to ensure you have the access desired.
If the system where you are creating the null session share is running Windows 2003 Server, you will also need to enable the Group Policy “Network access: Let Everyone permissions apply to anonymous users”. You can do this by doing the following: If the computer that is hosting the shared files has the value “HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA\\RestrictAnonymous” set to 1 or 2, then the BES Clients will not be able to access the shared files. You will need to set the RestrictAnonymous value to 0 to allow the BES Clients access to the shared files.