Creating Null Session Shares
1. NSS for RIS clients
When network installing Microsoft RIS OSs (Windows 2000, Windows XP, Windows Server 2003) it is necessary the creation of a "Null Session Share" (NSS). This kind of share got some bad reputation in the past from a security point of view, therefore setting them up on modern OSs it's not just a straight forward single-step action; it involves a bit of effort. This section tries to help Serva users creating their NSSs on different host platforms.
Select your host OS.
Windows 2000
- Enabling File Sharing:
- Click [Start]/Settings/Network and Dial-up Connections
- Right click the "Local Area Connection" icon.
- Click Install/Service.
- Click [Add...]
- Select "File and Printer Sharing for Microsoft Networks"
- Re-boot.
- Enabling the Guest Account:
- [Start]/Settings/Control Panel
- Open "Users and Passwords" and click the "Advanced" Tab.
- In the "Advanced User Management" section click "Advanced"
- Open the "Users" folder and click the "Guest" user
- Un-check "Account is disabled" and click [OK]
- Close the "Local Users and Groups" dialog and click [OK].
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Sharing..."
- Select "Share this folder"
- Click "New Share"
- Add "Share Name" = WIA_RIS_SHARE and click OK
- Select any "Share Name" different than WIA_RIS_SHARE from the combo-box and click [Remove Share]
- Verify "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only.
Windows XP
- Enabling Simple File Sharing (Windows XP Professional):
- [Start]/Control Panel, click "Switch to Classic View" and then the "Folder Options" icon.
- Select the "View" tab.
- Under the "Advanced settings" section select the "File and Folders/Use simple file sharing (Recommended)" check box.
- Click [OK] to close the "Folder Options" dialog box.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Sharing and Security..."
- If remote access is disabled:
- Under the "Network sharing and security" section click "If you understand the security risks but want to share files without running the wizard, click here."
- In the next "Enable File Sharing" dialog box, select the "Just enable file sharing" radio button, and then click [OK].
- Check "Share this folder on the network" with "Share Name" = WIA_RIS_SHARE
- Click [OK] to close the Properties dialog box.
- Click [Yes] (share anyway) to the warning about share names longer than 12 characters.
- Open the Control Panel and then select "Administrative Tools" and then "Services". Next Right-click the "Server" service and select Restart to restart the service.
Windows Server 2003
- Enabling the Guest Account:
- Run lusrmgr.msc (Local Users and Groups)
- Open the "Users" folder and click the "Guest" user
- Un-check "Account is disabled" and click [OK]
- Close lusrmgr.msc (Local Users and Groups)
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab.
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only and click [OK].
- Back at the Properties dialog now select the "Security" tab
- Click [Add..], enter the user "Guest" and click [OK]
- Selecting the user "Guest" at the "Group or user names:" pane edit its permissions at the "Permissions for Guest" pane. Make sure you check the "Allow" column with "Read & execute", "List folder contents" and, "Read" permissions, then click [OK].
Windows Vista
- Enabling Anonymous Logon:
- Open the Control Panel and navigate to:
Network and Internet\Network and Sharing Center\Sharing and Discovery\
Turn off:
password protected sharing
- Save changes and close the Control Panel.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only.
Windows Server 2008
- Enabling Anonymous Logon:
1. Run the Control Panel
2.
Navigate to:
Network and Internet\Network and Sharing Center\Change advanced sharing settings\
Select:
Turn off password protected sharing
3. Save changes and close the Control Panel.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click [Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only and click [OK] twice.
- Back at the Properties dialog now select the "Security" tab and click [Edit...]
- Click [Add..], enter the user "Guest" and click [OK]
- Selecting the user "Guest" at the "Group or user names:" pane edit its permissions at the "Permissions for Guest" pane. Make sure you check the "Allow" column with "Read & execute", "List folder contents" and, "Read" permissions, then click [OK] and [Close].
Windows 7
- Enabling Anonymous Logon:
1. Run the Control Panel
2.
Navigate to:
Network and Internet\Network and Sharing Center\Change advanced sharing settings\
Select:
Turn off password protected sharing
3. Save changes and close the Control Panel.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click [Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only and click [OK] twice.
- Back at the Properties dialog now select the "Security" tab and click [Edit...]
- Click [Add..], enter the user "Guest" and click [OK]
- Selecting the user "Guest" at the "Group or user names:" pane edit its permissions at the "Permissions for Guest" pane. Make sure you check the "Allow" column with "Read & execute", "List folder contents" and, "Read" permissions, then click [OK] twice.
Windows Server 2012
- Enabling Anonymous Logon:
1. Run the Control Panel
2.
Navigate to:
Network and Internet\Network and Sharing Center\Change advanced sharing settings\
Select:
Turn off password protected sharing
3. Save changes and close the Control Panel.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click [Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only and click [OK] twice.
- Back at the Properties dialog now select the "Security" tab and click [Edit...]
- Click [Add..], enter the user "Guest" and click [OK]
- Selecting the user "Guest" at the "Group or user names:" pane edit its permissions at the "Permissions for Guest" pane. Make sure you check the "Allow" column with "Read & execute", "List folder contents" and, "Read" permissions, then click [OK] and [Close].
Windows 8/8.1
- Enabling Anonymous Logon:
1. Click [Win-Logo]+[X] run the Control Panel
2.
Navigate to:
Network and Internet\Network and Sharing Center\Change advanced sharing settings\
Select:
Turn off password protected sharing
3. Save changes and close the Control Panel.
- Creating the Share:
- From the Metro UI click on Desktop
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click [Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only.
Windows 10
- Enabling Anonymous Logon:
1. Search and run the Control Panel
2.
Navigate to:
Network and Internet\Network and Sharing Center\Change advanced sharing settings\
Select:
Turn off password protected sharing
3. Save changes and close the Control Panel.
- Creating the Share:
- From File Explorer right click the TFTP root directory and select "Properties."
- Select the "Sharing" tab and click [Advanced Sharing...]
- Check "Share this folder", set "Share Name" = WIA_RIS_SHARE and click [Permissions]
- Remove all users/groups then add the user "Guest" with "Read" rights only.
- The required SMBv1 is not installed by default in Windows 10 Fall Creators Update and Windows Server, version 1709 and later versions
- Click and open the "Search Bar" in Windows 10.
Type Windows Features in the search bar.
Double Click "Turn Windows Features off and On"
- Scroll down to:
[ ] SMB 1.0/CIFS File Sharing Support
- Check the box:
[ ] SMB 1.0/CIFS Server
and click OK to accept the changes.
2. NSS for older clients
The SMB (Server Message Block) Protocol used by Microsoft shares supports dialect negotiation. A dialect is a version of the Protocol that is generally defined in terms of additions and changes relative to a previous version.
RIS clients when requiring the services of the NSS are able to negotiate a dialect called "CIFS" (also known as “NT LAN Manager” or, simply “NT LANMAN”) which is identified by the dialect string "NT LM 0.12". The instructions for creating an NSS included in the previous section, consider all RIS clients are by default able to use the "NT LM 0.12" dialect against any host running Windows 2000 and up.
In the case you need to create an NSS for a client (other than RIS) that mandatorily requires older dialects like “LANMAN1.0”, “LANMAN1.2”, etc, then you might need extra steps in order to enable those old dialects in your host; i.e.
Run the program "Regedit"
- Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\
Edit the multi-string (REG_MULTI_SZ) value "NullSessionShares" and add the share name on a new line.
-
Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\
Edit the 32-bit value (REG_DWORD) value "restrictanonymous" and set it to 0.
NOTE 1: These additional steps are not required if you are just trying to install a RIS OS with Serva.
NOTE 2: Some of the described procedures involve registry editing and other administrative tasks. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs.
Confirmed errors or comments on how to improve the information contained in this document please contact us here.
| Updated
| 11/12/2018
|
| Originally published
| 05/08/2012 |
