Цитата 4.6.2 NULL sessions and infrastructure-level restrictions

...
The IPC$ share does not appear in this registry value. However, it is always possible to connect anonymously to it. Restrictions for the IPC$ share are implemented at the named pipes level: Key: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Value: NullSessionPipes (REG_SZ)
...
Starting with Windows XP, this registry value can be set via a security option:
Network access: Pipes that can be accessed anonymously
However, just like IPC$ does not appear in the NullSessionShares value, it is always possible to anonymously connect to the following pipes, which are hardcoded in the npfs.sys driver:
pipelsarpc, pipesamr, pipenetlogon (pipelsass aliases)
pipewkssvc, pipesrvsvc, pipebrowser (pipentsvcs aliases)

Thus, it is possible to open the lsarpc named pipe in the context of a NULL session (but not the lsass named pipe, even if the first one is an alias of the second one, as explained earlier).

As for named pipes permissions, it is possible to use the pipeacl tool mentionned earlier to examine security descriptors set on named pipes.

In Windows 2000, named pipes DACL seem to grant permissions to the EVERYONE group and Administrators builtin. In Windows Server 2003, the DACL grant permissions to EVERYONE, ANONYMOUS LOGON and Administrator, because in Windows XP and Windows Server 2003, the following registry value is set to 0:
Key: HKLM\SYSTEM\CurrentControlSet\Control\LSA Value: EveryoneIncludesAnonymous
Content: 0 (default value)

The counterpart security option is:
Network access: Let Everyone permissions apply to anonymous users (disabled by default)