Network access: Do not allow anonymous enumeration of SAM accounts and shares
This registry value corresponds to the Windows security option that controls anonymous enumeration of Security Accounts Manager (SAM) accounts and network shares.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous
This registry value corresponds to the Windows security option that controls anonymous enumeration of Security Accounts Manager (SAM) accounts and network shares. Its type is DWORD. A value of 1 enables the restriction: unauthenticated network connections cannot enumerate the affected account names and share names.
The setting prevents anonymous enumeration only. It does not restrict authenticated users or replace the permissions assigned to shares, files, or other resources. Whether an anonymous connection can access a particular resource continues to depend on that resource’s access permissions and other security policies.
Notes
Security
Restricting enumeration reduces the information that an unauthenticated attacker can collect while preparing further attacks. Exposed account and share names could otherwise assist targeted password attempts or social-engineering attacks.
The value does not grant or revoke general file-access rights. It therefore does not prevent access that other permissions or policies explicitly allow.
Possible side effects
Anonymous clients can no longer list available shared folders and printers. Applications or legacy network environments that depend on anonymous enumeration might consequently be unable to discover shares or accounts automatically.
The restriction can also interfere with older cross-domain scenarios that require account enumeration across a one-way trust. Microsoft’s historical policy reference specifically identifies incompatibilities with Windows NT 4.0 trusts and very old Windows clients.
Notes
Do not confuse RestrictAnonymous with RestrictAnonymousSAM. RestrictAnonymous covers anonymous enumeration of both SAM accounts and shares, whereas RestrictAnonymousSAM belongs to the separate security option that restricts enumeration of SAM accounts only.
Microsoft’s older security-policy reference states that this setting has no effect on domain controllers. The current Policy CSP reference continues to document it as a device-scoped security option but does not further clarify its behavior on domain controllers.
Microsoft documentation
Microsoft Learn: Network access: Do not allow anonymous enumeration of SAM accounts and shares