ANONYMOUS_SID_SETTING
This policy item checks for the following value defined in “Security Settings -> Local Policies -> Security Options -> Network
access: Allow anonymous SID/Name translation”. The check is performed by calling the function
LsaQuerySecurityObject
on the LSA policy handle.
Usage
<custom_item>
type: ANONYMOUS_SID_SETTING
description: ["description"]
value_type: [VALUE_TYPE]
value_data: [value]
(optional) check_type: [value]
</custom_item>
The allowed types are:
value_type: POLICY_SET
value_data: "Enabled" or "Disabled"
When using this audit, please note that this policy:
- is a permission check on the LSA service
- checks if the ANONYMOUS_USER has the flag POLICY_LOOKUP_NAMES set
- is deprecated on Windows 2003 because an anonymous user cannot access the LSA pipe
Example
<custom_item>
type: ANONYMOUS_SID_SETTING
description: "Network access: Allow anonymous SID/Name translation"
value_type: POLICY_SET
value_data: "Disabled"
</custom_item>