[SkyF]

ну вообще тупик.

давайте по порядку.
читаем статью Роберты Брагг, как БЛОКИРОВАТЬ анонимные подключения: Checklist: Block anonymous access и делаем в вашем случае все НАОБОРОТ.

вот этот список:

1. Disable the option "Network Access: Allow anonymous SID/name translation." This option, once disabled, prevents anonymous SID/name translation. Combine this option with the one below to keep an attacker from using an anonymous connection to deduce account names. 2. Enable the option "Network Access: Do not allow anonymous enumeration of SAM accounts." When enabled, this option prevents the enumeration of the user account list via an anonymous connection. When both this and the above security options are used, you can keep the changed name of the Administrator account hidden from an attacker using an anonymous connection. 3. Enable the option "Network Access: Do not allow anonymous enumeration of SAM accounts/shares." When enabled, this option also prevents anonymous enumeration of shares. Shares offer opportunities for system connections and data theft. If shares are properly protected by permissions, then anonymous access won't matter. If share permissions are not correct, or when they inadvertently offer access to an anonymous connection, you need to block anonymous connection to stop data theft. This option comes in handy on systems like Windows 2000, which include the anonymous SID in the Everyone group, where the group is given access permissions. 4. Disable the option "Network Access: Let Everyone permissions apply to anonymous users." On Windows XP and Windows Server 2003 systems, anonymous users are excluded from the Everyone group and cannot gain access to resources given to that group. Keep this option disabled to prevent access. 5. Enter the names of named pipes if necessary in option "Network Access: Named Pipes that can be accessed anonymously." Named pipes are another way network connections can be made by client/server programs. In this scenario, one part of a program runs on one computer and another part on another computer. Some legacy programs require anonymous access over these named pipes. If anonymous access is blocked, use this option to allow it where required. 6. Enter the name of shares if necessary in the option "Network Access: Shares that can be accessed anonymously." Here again, some legacy applications may require anonymous access to shares. Instead of allowing anonymous access to all shares, enter the names of shares that require anonymous access.

И еще нас (те вас) блокируют при доступе к ресурсу IPC$ - не именнованный ли это канал?
(судя по картинкам в режиме доступа анонимных пользователей он у вас разрешен, если не ошибаюсь: Network access: Named pipes that can be accessed anonymously - разные там comnap netlogon browser LSARPC и тп) PS ТАм не видно дальше по картинке, а имена SRVSVC и WKSSVC там упомянуты в списке разрешенных?

те я к тому, что со списками доступа общих точек подключения все ок (доступ-то к ним есть), вот к каналу SRVSVC доступ закрыт.

давайте попробуем в этом направлении поискать.
например тут:
Windows network services internals
особливо в этих режимах:

• 4.6 NULL sessions
  4.6.1 Introduction
  4.6.2 NULL sessions and infrastructure-level restrictions
  4.6.3 NULL sessions - system-level restrictions
  4.6.4 How NULL sessions restrictions are implemented
  4.6.5 NULL sessions restrictions in Windows XP and Windows Server 2003
• 4.7 RPC services listening on named pipes
  4.7.1 lsarpc interface
  4.7.2 samr interface
  4.7.3 netlogon interface
  4.7.4 browser interface
  4.7.5 netdfs interface
  4.7.6 srvsvc interface
  4.7.7 svcctl interface
  4.7.8 winreg interface
  4.7.9 wkssvc interface

вот это может то что мы ищем:

... The IPC$ share does not appear in this registry value. However, it is always possible to connect anonymously to it. Restrictions for the IPC$ share are implemented at the named pipes level: Key: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Value: NullSessionPipes (REG_SZ) ... Starting with Windows XP, this registry value can be set via a security option: Network access: Pipes that can be accessed anonymously However, just like IPC$ does not appear in the NullSessionShares value, it is always possible to anonymously connect to the following pipes, which are hardcoded in the npfs.sys driver: pipelsarpc, pipesamr, pipenetlogon (pipelsass aliases) pipewkssvc, pipesrvsvc, pipebrowser (pipentsvcs aliases) Thus, it is possible to open the lsarpc named pipe in the context of a NULL session (but not the lsass named pipe, even if the first one is an alias of the second one, as explained earlier). As for named pipes permissions, it is possible to use the pipeacl tool mentionned earlier to examine security descriptors set on named pipes. In Windows 2000, named pipes DACL seem to grant permissions to the EVERYONE group and Administrators builtin. In Windows Server 2003, the DACL grant permissions to EVERYONE, ANONYMOUS LOGON and Administrator, because in Windows XP and Windows Server 2003, the following registry value is set to 0: Key: HKLM\SYSTEM\CurrentControlSet\Control\LSA Value: EveryoneIncludesAnonymous Content: 0 (default value) The counterpart security option is: Network access: Let Everyone permissions apply to anonymous users (disabled by default)

из этого следует два важных момента:
- упоминается утилита pipeacl которая может помочь при работе с именованными каналами
(берем тут PipeACL tools v1.0 или из этого набора утилит выбираем Win32 Pipe Security Editor Windows NT/2000/XP )
-- Не забываем об утилите Марка Русиновича Pipelist - по выводу списка каналов

- и опять, нам указывают в параметры безопасности like Network access: Let Everyone <bla...bla>



кстати, более грамотный ресурс дублирующий вышеуказанный материал:
Windows network services internals
и далее из него же: Windows network services internals - HiverCon 03

Возможно и SP1 и прикрывает какие-то возможности для анонимных пользователей в силу большого простора для атак по этому направлению: MSRPC NULL sessions - exploitation and protection /29 June 2005/

ЗЫ перерывчик..