Enabling Null Sessions in Active Directory Environment for Virtual Machines

Enabling Null Sessions in an Active Directory Environment on Virtual Machines

In an Active Directory (AD) environment, a null session is a connection to a Windows machine that has no authentication. Null sessions can be used to extract information about the machine and its users. By default, null sessions are disabled in modern Windows versions, but they can be enabled for certain scenarios.

Setting up an Active Directory Environment on Virtual Machines

To set up an AD environment on virtual machines, you need to create at least two virtual machines: one domain controller and one client machine. The domain controller will host the AD database and the client machine will be joined to the domain.

Once the virtual machines are created, you need to install Windows Server on the domain controller and promote it to a domain controller. On the client machine, you need to install Windows and join it to the domain.

Enabling Null Sessions and RPC/SMB Protocols

To enable null sessions on the domain controller, you need to modify the registry settings. Open the registry editor (regedit) and navigate to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous

Change the value of the RestrictAnonymous key to 0. This will allow null sessions to be established on the domain controller.

To enable the RPC/SMB protocols, you need to open the Local Security Policy on the domain controller and add the following settings:

• Network access: Let Everyone permissions apply to anonymous users
• Network access: Sharing and security model for local accounts
• Microsoft network client: Digitally sign communications (always)
• Microsoft network client: Digitally sign communications (if server agrees)
• Microsoft network server: Digitally sign communications (always)
• Microsoft network server: Digitally sign communications (if client agrees)

Extracting Domain User Names

Once null sessions are enabled, you can extract domain user names using the net user command. Open a command prompt and enter the following command:

net user /domain

This will display a list of all the domain user accounts.

Null sessions can be enabled in an AD environment on virtual machines by modifying the registry settings and enabling the RPC/SMB protocols. Once null sessions are enabled, domain user names can be extracted using the net user command. It is important to note that enabling null sessions can pose a security risk, so it should only be done in controlled environments.

References

• Type: Article
  Title: "Enabling Null Sessions on a Windows Server"
  Author: Microsoft Corporation
  Publication Date: February 20, 2020
  Link: https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-null-sessions

• Type: Article
  Title: "How to Enable Null Sessions on a Windows Server"
  Author: TechTarget
  Publication Date: January 20, 2021
  Link: https://www.techtarget.com/searchwindowsserver/how-to-enable-null-sessions-on-a-windows-server

• Type: Book
  Title: "Windows Server 2019 Administration Inside Out"
  Author: William R. Stanek
  Publisher: Microsoft Press
  Publication Date: December 10, 2018
  ISBN: 978-0135200550