Network access: Restrict clients allowed to make remote calls to SAM
This string value (`REG_SZ`) contains a security descriptor expressed in Security Descriptor Definition Language (SDDL).
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictRemoteSAM
This string value (REG_SZ) contains a security descriptor expressed in Security Descriptor Definition Language (SDDL). Windows uses its access control list to perform an additional authorization check on incoming calls through the SAMRPC protocol. The check determines which security principals may remotely access the local Security Accounts Manager (SAM) database or, on a domain controller, Active Directory.
The value O:BAG:BAD:(A;;RC;;;BA) assigns the built-in Administrators group (BA) as the owner and primary group. Its DACL contains a single allow entry granting members of that Administrators group RC (READ_CONTROL) for the SAMRPC access check. Remote calls from other security principals fail this check.
This restricts remote enumeration of users, groups, and group memberships to administrators of the target system. It does not generally control network logons, Remote Desktop, SMB shares, or unrelated RPC interfaces.
Notes
Security
Without an appropriate restriction, low-privilege accounts can use SAMRPC to obtain information about users, privileged accounts, groups, and group memberships. An attacker can use this information to understand the structure of a computer or domain and identify targets for further attacks.
The configured security descriptor reduces that exposure by rejecting non-administrative remote clients at the SAMRPC interface. Passing this check does not confer full administrative privileges or unrestricted access to account data or other system resources. On domain controllers, permissions applying to individual Active Directory objects also remain in effect.
Possible side effects
Applications and services can receive access-denied errors if they remotely query users, groups, or memberships through SAMRPC and their security context is not a member of the target system's built-in Administrators group.
Affected functions can include offline address book generation in certain Exchange versions, password writeback through Microsoft Entra Connect, and some group-membership checks performed by Remote Desktop license servers. The actual impact depends on whether the component uses remote SAM calls and which account it uses for those calls.
Notes
The corresponding Windows security option is available in the management interface beginning with Windows 10, version 1607 and Windows Server 2016. Supported earlier systems can also honor the underlying registry setting when the applicable Windows updates are installed.
On a domain controller, the restriction applies to remote SAMRPC access to Active Directory. The explicit value documented here must therefore be distinguished from the version-dependent, hard-coded behavior Windows uses when the registry value is absent.
Microsoft documentation
Microsoft Learn: Network access—Restrict clients allowed to make remote calls to SAM
Microsoft Learn: Access checks fail because of AuthZ