1025｜One or more named pipes or shares have been marked for access by anonymous users. This incr

這個指令做什麼？

事件調查：One or more named pipes or shares have been marked for access by anonymous users. This incr。固定提供者 Microsoft-Windows-SMBServer；事件 ID 1025。讀取事件證據，不代表偵測到入侵；需結合上下文判讀。 One or more named pipes or shares have been marked for access by anonymous users. This increases the security risk of the computer by allowing unauthenticated users to connect to this server. Registry Key: HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters Registry Values: NullSessionPipes, NullSessionShares Default Value: Empty (or not present) Current Value: Non-empty Guidance: You should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.