#$&% 203th Official Hard at Work Thread $%$
Joined: May 2004
Posts: 17,254
Likes: 75
From: VA
Originally Posted by e3opian,Apr 22 2009, 05:12 PM
Ok, here's the thing. I need PsExec to work to remotely push Office 2007 without AD / GPO.
With PsExec, I can copy a batch script to the remote machine which executes and maps a network share and installs Office 2007 with credentials. This is tested.
But the Admin$ share isn't working on a bunch of the machines.
With PsExec, I can copy a batch script to the remote machine which executes and maps a network share and installs Office 2007 with credentials. This is tested.
But the Admin$ share isn't working on a bunch of the machines.
This problem is caused when the "RestrictAnonymous" LSA registry value in XP gets changed from its default value of "0" (disabled) to "1" (enabled). This registry value can be located by opening regedit and going to:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa]
A more user friendly way of adjusting this same setting is to go to Control Panel --> Administrative Tools --> Local Security Policy --> Local Policies --> Security Options. Make sure the following setting is set to "Disabled":
-- Network access: Do not allow anonymous enumeration of SAM accounts and shares
Do not confuse this setting with the setting that preceeds it not including the text "and shares" at the end of it. That's an entirely different setting that should be "Enabled" by default!
The following text is what Eric on the internet had to say about the issue:
Source: http://cert.uni-stuttgart.de/archive/focus...3/msg00088.html
"Null sessions can *always* be established to NT4, Windows 2000, and Windows
XP machines. If the machine's server service is enabled, and ports 139 or
445 are available, then you can do a net use with anonymous credentials,
and the system will respond with "Command completed successfully". This
has not changed from NT4 to Win2K to XP.
What has changed, however, is what you are able to do once you establish
the null session. In NT4 and Win2K, by default, you could enumerate
information about users and shares. Setting RestrictAnonymous=1 would help
prevent against this enumaration (though not fully). RestrictAnonymous=2
(Win2K only) would fully prevent this enumeration.
On Windows XP, there are new registry keys:
RestrictAnonymousSam=1 is a default setting. This prevents detailed
enumeration of user accounts. This setting correlates with the
SecurityPolicy setting "Do not allow anonymous enumeration of SAM
accounts" with a default setting 'Enabled" (meaning the default of XP will
prohibit anonymous enumeration (R.A.SAM=1).
RestrictAnonymous=0 is a default setting. This correlates with the
SecurityPolicy Setting "Do not allow anonymous enumeration of SAM accounts
and shares". Set this policy to 'Enabled' (RA=1) to prevent anonymous
enumeration of shares.
RestrictAnonymous=2 (on XP) is no longer a valid setting.
So, by default, on an XP system, you can anonymously connect and enumerate
shares by default, but you cannot enumerate detailed user information.
To disable anonymous connections altogether, block access to tcp139/445
(IPSec port filters or Internet Connection Firewall), or uncheck "File and
Print Sharing for Microsoft Networks" from the network interface in
question (via the properties tab of the network connection)."
Joined: Jan 2003
Posts: 21,401
Likes: 0
From: Arlington, Virginia
Originally Posted by e3opian,Apr 22 2009, 05:10 PM
If I do something I shouldn't on the network, they're going to have to dig a bit more to find out who it is. 
we also have a group named Operations Management Group...
a excerpt from their intranet site:
[QUOTE]Monthly Speaker Series
Joined: Jul 2005
Posts: 28,456
Likes: 228
If however you do not have this set and you have just lost the ADMIN$ share which points to the %SytemRoot% folder, e.g. d:\winnt then you can recreate it by entering the following command:
C:\> net share admin$
C:\> net share admin$
Wonder if that would be a one-time fix. If so, I'll invest the time walking around for that.
