restrict clients allowed to make remote sam calls

John Curtiss 66 Reputation points
2021-06-03T14:24:26.983+00:00

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls

network access - restrict clients allowed to make remote calls to SAM

if i'm reading this article correctly, it says "the default security descriptor" is given this right if policy is not configured. and that the "default security descriptor" on workstations and member servers is "administrators", but on domain controllers, it is "everyone". however, i just promoted a bunch of 2016 DCs, and this does not seem to be the case.

i have nothing set in gpo for this setting for domain controllers. if i do RSOP on a DC or a member server, the security descriptor is blank for this setting. if i do gpedit on a domain controller, the local security policy says O:BAG:BAD:(A;;RC;;;BA) and has domain\administrators when i click 'edit security'.

on member servers, i do have this explicitly set to administrators, and rsop has the same security descriptor O:BAG:BAD:(A;;RC;;;BA), but has the localserver\administrators in edit security. (not domain\administrators)

  1. are 2016 domain controllers really supposed to have "everyone" in this?
  2. by default?
  3. any thoughts on why mine don't have "everyone" in this by default?

edit - this came up because we use cyberark to automatically rotate certain passwords. so if i have a cyberark-managed account called "CyberarkAccount1," every couple of days, cyberark logs into AD as that account and changes its password. this has been working for years on 2012 R2 domain controllers, which don't have this "restrict clients who can make same calls" setting.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,787 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,925 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,732 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daisy Zhou 18,716 Reputation points Microsoft Vendor
    2021-06-04T07:55:17.303+00:00

    Hello @JohnpCurtiss,

    Thank you for posting here.

    Here are the answers for your references.

    Q1: but on domain controllers, it is "everyone". however, i just promoted a bunch of 2016 DCs, and this does not seem to be the case.
    A1: By default, we can see the setting is "Not Defined" (we cannot explicitly see Everyone on Domain Controller or see "administrators" on member servers,), but they have such "Existing" setting on different versions of Windows as the article mentioned.

    102364-de.png

    Q2: are 2016 domain controllers really supposed to have "everyone" in this?
    A2: Yes, see A1.

    Q3: this has been working for years on 2012 R2 domain controllers, which don't have this "restrict clients who can make same calls" setting.
    A3: The setting was first supported by Windows 10 version 1607 and Windows Server 2016 (RTM) and can be configured on earlier Windows client and server operating systems by installing updates from the KB articles listed in Applies to section of this topic.

    102376-hot1.png

    In my lab Windows server 2012 R2 DC, because I did not install KB4012219 on this DC, I cannot see such gpo setting (network access - restrict clients allowed to make remote calls to SAM), either.

    Hope the information above is helpful.

    Should you have any question or concern, please feel free to let us know.

    Best Regards,
    Daisy Zhou

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

  2. John Curtiss 66 Reputation points
    2021-06-06T02:51:16.747+00:00

    it was still set to "administrators" on all my 2016 dcs, in two separate domains, via their local group policies. I had to set up domain gpos for the domain controllers OUs in each domain explicitly setting this to "everyone." I'm still kind of curious why they didn't switch from "administrators" to "everyone" automatically when they were promoted to dcs, if that is the default setting for dcs. but I guess that's moot now.