Pre-Windows 2000 Compatible Access and anonymous access: closing directory enumeration

The Pre-Windows 2000 Compatible Access group

This built-in group exists for compatibility with systems older than Windows 2000 (Windows NT remote access servers, for example). Its members get read access to user and group objects in the domain. Depending on the choice made when the domain was created, it contains:

• Authenticated Users, if permissions compatible only with Windows 2000 and later were selected;
• Everyone and sometimes Anonymous Logon, if permissions compatible with earlier versions were chosen.

In the second case, any machine on the network, with no credentials, can query the directory and retrieve the list of accounts, groups and their members. It is an ideal first step for preparing a password spray or targeting privileged accounts.

Even the Authenticated Users configuration deserves scrutiny: the group is rarely needed today, and emptying it reduces read exposure with no impact in most modern environments. Test anyway, because some older applications rely on these rights.

Anonymous LDAP access and dSHeuristics

By default, since Windows Server 2003, a domain controller only accepts an anonymous bind and a read of the root object (rootDSE), which exposes technical information but not the directory's content. This behaviour is governed by the dSHeuristics attribute on the directory service configuration object. The seventh character of that string, when set to 2, allows anonymous LDAP operations beyond that minimum; combined with ACLs granting rights to Anonymous Logon, it opens the directory to unauthenticated reads.

This value is sometimes set for a legacy application and then forgotten. It applies to the whole forest. If it is present, identify the application that depends on it and replace anonymous access with a dedicated service account.

Null sessions and SAMR enumeration

Anonymous enumeration also goes through SMB null sessions and RPC interfaces such as SAMR and LSARPC. Several security options in Group Policy govern this access:

On domain controllers, some interfaces stay reachable for operational reasons, and the setting that restricts which clients may make remote calls to SAM behaves differently depending on the machine's role. Check Microsoft's documentation for each option and test the effect on domain controllers before rolling it out broadly.

Hardening without breaking things

1. Inventory the current membership of Pre-Windows 2000 Compatible Access and the value of dSHeuristics.
2. Enable logging of anonymous LDAP and SMB access on domain controllers to identify the clients involved.
3. Remove Anonymous Logon and Everyone from the group, then, after observation, consider removing Authenticated Users.
4. Apply the security options through a GPO dedicated to domain controllers.
5. Confirm from an unauthenticated machine that enumeration fails.

What an audit checks

• the members of Pre-Windows 2000 Compatible Access in each domain;
• the value of dSHeuristics and any rights granted to Anonymous Logon;
• the "Network access" security options applied to domain controllers;
• the outcome of an anonymous LDAP and SAMR enumeration attempt;
• pre-created computer accounts that were never used.