Access This Computer From the Network – Best Practices for DC and Member Servers

What does access this computer from the network mean?

This policy enables users on the network to establish connections with the computer, and it’s necessary for several network protocols such as Server Message Block (SMB), NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+).

The recommended state for this setting is: Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS.

The purpose of this setting is to allow users who can connect from their own computers to the network to access resources on specific computers, provided they have the necessary permissions. For example, the “Access this computer from the network” user privilege is required for users to connect to shared printers and directories. Granting this privilege to the Everyone group means anyone can access the files in those shared directories. However, this scenario is unlikely in new installations of Windows Server 2003 with Service Pack 1 (SP1) because the default share and NTFS permissions don’t include the Everyone group. Nonetheless, this vulnerability may present a higher risk for computers upgraded from Windows NT 4.0 or Windows 2000, as the default permissions in these operating systems aren’t as strict as those in Windows Server 2003.

After years of relying on traditional manual tools for hardening, we’ve come to the realization that incorporating hardening automation tools is crucial for ensuring the success of a hardening project and maintaining a strong compliance posture. Delve deeper into the realm of server hardening automation to enhance your understanding.

Access this computer from the network - potential vulnerability

When you don't limit who can access your machines from the network, un-invited malicious users can take advantage of this to access and read protected data. For example, shared printers and folders.

Note! The default value of this setting includes 'Everyone'. Therefore, you must harden this setting, or you'll be highly exposed to attacks.

Countermeasures

Allow only users that require to access the computer from the network to do so.

There are 4 cases to consider:

1. Domain Controllers: allow access only to Administrators, Authenticated users, Enterprise Domain Controllers.
2. Member Servers and Endpoints: allow access only to Administrators, Authenticated users.
3. High-security environment: aim to restrict access from all users if possible.
4. End Points – allow access only to Authenticated Users and Administrators.

The potential impact configuration change

System components such as ASP.NET and IIS servers might be impacted from this hardening action. Determine which user accounts need to have access for the network, for these components to continue working properly.

In addition, there are few network protocols that require access from the computer:

1. Server Message Block (SMB) protocols
2. NetBIOS
3. Common Internet File System (CIFS)
4. Component Object Model Plus (COM+)

Before changing this setting, make sure you're not using these protocols.

Criticality

CIS labels this setting, both for Domain Controllers and for Member Servers as Level 1- which means that it should be at your top priority in your hardening project.

How do I change access this computer from network policy?

For domain controllers verify the effective setting in Local Group Policy Editor.

Run “gpedit.msc”.

Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

The best approach for this configuration change is to use hardening automation. By doing that, you'll automatically get an impact analysis and will be able to enforce you're desired settings on the entire production from a single point of control.

Changing access using a Registry Key

You normally can’t control user rights settings using registry keys, but there is a possible hack for this one.

Look where your policy information is stored. Possible locations will be:

HKEY_LOCAL_MACHINE\Software\Policies 
HKEY_CURRENT_USER\Software\Policies 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies 

Find the policy and change it according to your needs.