๐ผ Management Samenvatting
Schakel uit anonymous SAM enumeration - voorkomt unauthenticated attackers van listing local accounts (reconnaissance).
Aanbeveling
IMPLEMENT
Risico zonder
Medium
Risk Score
5/10
Implementatie
2u (tech: 1u)
Van toepassing op:
โ Windows 10
โ Windows 11
โ Windows 11
Anonymous SAM enumeration = reconnaissance: SAM (Security Account Manager): Local account database, Anonymous enumeration: Attacker zonder credentials kan query: List all local accounts, Enumerate usernames, Identify admin accounts. Attack: Anonymous SAM enum โ list accounts โ targeted brute-force. Defense: Schakel uit anonymous access โ authentication required.
PowerShell Modules Vereist
Primary API: Microsoft Graph API
Connection:
Required Modules: Microsoft.Graph.DeviceManagement
Connection:
Connect-MgGraphRequired Modules: Microsoft.Graph.DeviceManagement
Implementatie
Schakel uit SAM enum: Policy: Network access: Do not allow anonymous enumeration of SAM accounts: Enabled, Effect: Anonymous users CANNOT list accounts, Authentication required: Domain/local credentials needed.
Vereisten
- Intune subscription
- Windows 10/11
Implementatie
Intune Settings Catalog: Local Policies Security Options โ Network access: Do not allow anonymous enumeration of SAM accounts: Enabled.
Compliance
CIS Windows Benchmark L1, BIO 09.02, ISO 27001 A.13.1.3.
Monitoring
Gebruik PowerShell-script anonymous-enumeration-disabled.ps1 (functie Invoke-Monitoring) โ Controleren.
Remediatie
Gebruik PowerShell-script anonymous-enumeration-disabled.ps1 (functie Invoke-Remediation) โ Herstellen.
Compliance & Frameworks
- CIS M365: Control Windows - Anonymous SAM (L1) -
- BIO: 09.02.04 -
- ISO 27001:2022: A.13.1.3 -
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
<#
.SYNOPSIS
Intune Security Options: Anonymous Enumeration Disabled
.DESCRIPTION
CIS - Anonymous SAM enumeration disabled.
.NOTES
Filename: anon-enum.ps1|Author: Nederlandse Baseline voor Veilige Cloud|Registry: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM|Expected: 1
#>
#Requires -Version 5.1
#Requires -RunAsAdministrator
[CmdletBinding()]param([switch]$WhatIf, [switch]$Monitoring, [switch]$Remediation, [switch]$Revert)
$ErrorActionPreference = 'Stop'; $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; $RegName = "RestrictAnonymousSAM"; $ExpectedValue = 1
function Connect-RequiredServices { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) }
function Test-Compliance {
$r = [PSCustomObject]@{ScriptName = "anon-enum.ps1"; PolicyName = "Anonymous Enumeration"; IsCompliant = $false; CurrentValue = $null; ExpectedValue = "Disabled"; Details = @() }; function Invoke-Revert { Set-ItemProperty -Path $RegPath -Name $RegName -Value 0 -Type DWord }
try { $v = Get-ItemProperty -Path $RegPath -Name $RegName -ErrorAction SilentlyContinue; if ($v -and $v.$RegName -eq $ExpectedValue) { $r.IsCompliant = $true; $r.Details += "Anonymous enum disabled" }else { $r.Details += "Anonymous enum enabled - RISK" } }catch { $r.Details += "Error: $($_.Exception.Message)" }; return $r
}
function Invoke-Remediation { Set-ItemProperty -Path $RegPath -Name $RegName -Value $ExpectedValue -Type DWord -Force; Write-Host "Anonymous enumeration disabled" -ForegroundColor Green }
function Invoke-Monitoring { $r = Test-Compliance; Write-Host "`n$($r.PolicyName): $(if($r.IsCompliant){'COMPLIANT'}else{'NON-COMPLIANT'})" -ForegroundColor $(if ($r.IsCompliant) { 'Green' }else { 'Red' }); return $r }
function Invoke-Revert { Set-ItemProperty -Path $RegPath -Name $RegName -Value 0 -Type DWord }
try { if (-not(Connect-RequiredServices)) { exit 1 }; if ($Monitoring) { $r = Invoke-Monitoring; exit $(if ($r.IsCompliant) { 0 }else { 1 }) }elseif ($Remediation) { if (-not $WhatIf) { Invoke-Remediation } }elseif ($Revert) { Invoke-Revert }else { $r = Test-Compliance; exit $(if ($r.IsCompliant) { 0 }else { 1 }) } }catch { Write-Error $_; exit 1 }
Risico zonder implementatie
Risico zonder implementatie
Medium: Medium: Anonymous SAM enum = account list for attackers (reconnaissance).
Management Samenvatting
Schakel uit anonymous SAM enumeration. Block account listing. Implementatie: 1-2 uur.
- Implementatietijd: 2 uur
- FTE required: 0.01 FTE