deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 19:03:46 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

revised reg info

Browse Source
This commit is contained in:
Justin Hall
2017-05-25 17:13:14 -07:00
parent 18a836504c
commit d430423d1a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
View File

@ -56,7 +56,7 @@ This less restrictive default allows for testing the impact of enabling restrict
| | |
|----|---|
| Policy Name | Network access: Restrict clients allowed to make remote calls to SAM |
| Location | `Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Option` |
| Location | Computer Configuration\|Windows Settings\|Security Settings\|Local Policies\|Security Option |
| Possible values | <br>- Not defined <br>- Defined, along with the security descriptor for users and groups who are allowed or denied to use SAMRPC to remotely access either the local SAM or Active Directory. |
| Registry location | `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSam` |
| Registry type | REG_SZ |
@ -97,8 +97,8 @@ Audit only mode configures the SAMRPC protocol to do the access check against th
|Registry|Details|
|---|---|
|Path|`HKEY_LOCAL_MACHINE|SYSTEM|CurrentControlSet|Control|Lsa`|
|Setting|`RestrictRemoteSamAuditOnlyMode`|
|Path|HKEY_LOCAL_MACHINE\|SYSTEM\|CurrentControlSet\|Control\|Lsa|
|Setting|RestrictRemoteSamAuditOnlyMode|
|Data Type|REG_DWORD|
|Value|1|
|Notes|This setting cannot be added or removed by using predefined Group Policy settings. <br> Administrators may create a custom policy to set the registry value if needed. <br> SAM responds dynamically to changes in this registry value without a reboot. <br> You can use the [Events 16962 - 16969 Reader](https://gallery.technet.microsoft.com/Events-16962-16969-Reader-2eae5f1d) script to parse the event logs, as explained in the next section.|