Security of ipc$ shared channel

Security of ipc$ shared channel

Ipc$ Sharing channel According to Microsoft's intention is to facilitate network management, but since being exploited by hackers, ipc$ intrusion has become the simplest way of intrusion.
It is recommended that you close this dangerous ipc$ shared channel.

1. Create a new string RestrictAnonymous in the Hkey_local_machine/system/currentcontrolset/control/lsa in Regedit. and set the value to 1, which prevents ipc$ Null connection
2. Delete all default shares of the system. Here are two ways, one is the net share c$/del,net share D$/del write a batch file, and then put him in the startup group. This will remove the default share every time the boot is turned on. The second is to modify the registry to turn on the second health: hkey_local_machine/system/currentcontrolset/services/lanmanserver/parameters
For the server, create a new DWORD type key value with the name AutoShareServer value set to 0
For workstations, create a new DWORD type key value with the name AutoShareWks value set to 0

Note: If you are a large server, especially a DC, it is not recommended that you delete the default share. To access the default shared full dependency administrator permissions. Just manage the administrator's user password. Conversely, if you turn off default sharing, many things cannot be done, such as DFS, replication between domains and domains, and so on.