Skip to content

AD-PRIV-005: Anonymous or Everyone in Pre-Windows 2000 Compatible Access

medium   Privileged access   MITRE ATT&CK T1087.002   Reads: LDAP

Anonymous Logon or Everyone is a member of Pre-Windows 2000 Compatible Access, which lets unauthenticated sessions read users and groups.

Why it matters

Pre-Windows 2000 Compatible Access exists for Windows NT 4.0 era systems. Its members have read access to all users and groups in the domain, and the DC uses the group when deciding what an unauthenticated (null) session over SAMR and LSA may enumerate.

When Anonymous Logon is a member, anyone who can reach a domain controller on the network, without any account, can list users, groups and memberships and read details such as the password policy. That user list is the input for password spraying against the lockout policy (AD-POL-001).

Everyone includes anonymous sessions only when the policy Network access: Let Everyone permissions apply to anonymous users is enabled, but a domain promoted with pre-Windows 2000 compatible permissions usually has both.

How ad-doctor detects it

ad-doctor reads the member attribute of the builtin group with SID S-1-5-32-554 and looks for the foreign security principals CN=S-1-5-7 (Anonymous Logon) and CN=S-1-1-0 (Everyone). Only direct membership is checked. The objects are Anonymous Logon and/or Everyone.

Authenticated Users (S-1-5-11), the default member in a domain created with Windows 2000-and-later permissions, is not reported.

Attributes and probes read
  • member of Pre-Windows 2000 Compatible Access (S-1-5-32-554)

Severity

Always medium. Nothing is taken over directly, but anonymous enumeration hands an outsider the user list for password spraying and the group structure for planning.

False positives and limits

  • Genuine NT 4.0-era dependencies (very old appliances or applications that query the domain anonymously) are the only reason to keep the membership. Replace or reconfigure them to authenticate; until then, accept the finding in an accepted-risk file with an expiry date.

Fix

  1. See the current members.

    (Get-ADGroup 'Pre-Windows 2000 Compatible Access' -Properties member).member

  2. Remove Anonymous Logon and Everyone. They are foreign security principals, so remove them by DN:

    $fsp = "CN=ForeignSecurityPrincipals,$((Get-ADDomain).DistinguishedName)"
Set-ADGroup 'Pre-Windows 2000 Compatible Access' `
    -Remove @{member = "CN=S-1-5-7,$fsp", "CN=S-1-1-0,$fsp"} -WhatIf

  3. Keep Authenticated Users in the group unless you have tested its removal: some applications read group membership of other users through it.

  4. Check the related anonymous-access settings: Network access: Let Everyone permissions apply to anonymous users should be disabled, and anonymous LDAP operations should stay blocked through dSHeuristics (AD-INF-004).

  5. Test from a machine outside the domain that a null session can no longer list users (for example with rpcclient -U '' -N dc01.corp.example -c enumdomusers).

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-PRIV-005

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-PRIV-005"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

MITRE ATT&CK

Available since 0.1.0.