Network access: Let Everyone permissions apply to anonymous users
A DWORD value of `0` causes Windows to exclude the Everyone SID (`S-1-1-0`) from access tokens created for anonymous connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous
A DWORD value of 0 causes Windows to exclude the Everyone SID (S-1-1-0) from access tokens created for anonymous connections. Permissions granted to Everyone therefore do not automatically authorize anonymous users.
Anonymous connections can access only resources for which they receive an applicable permission independently of the Everyone group.
Notes
Security
The value 0 prevents anonymous users from gaining access solely through permissions granted to Everyone. This reduces the exposure of resources and information—such as account names and network shares—that an unauthenticated user could otherwise use for password attacks or social-engineering attempts.
This value does not disable all anonymous access. Permissions explicitly granted to the ANONYMOUS LOGON identity (S-1-5-7), or granted through another applicable security principal, remain effective.
Notes
EveryoneIncludesAnonymous is a computer-wide REG_DWORD registry value. A value of 0 corresponds to the Windows security option being disabled. The alternative value 1 adds the Everyone SID to access tokens for anonymous connections and consequently expands their effective permissions.
Microsoft documentation
Microsoft Learn: Network access: Let Everyone permissions apply to anonymous users
Microsoft Learn: Special identity groups