SMB Administrator account without password

Description
  • It was possible to establish a SMB session using the Administrator account with a blank password.
Remediation
  • You need to limit local account use of blank passwords to console login only. <br/><br/> <ul> <li>[Start] [Run] and type <strong>gpedit.msc</strong> and click [OK]</li> <li>Navigate to Computer Configuration / Windows Settings / Security Settings / Local Policies / Security Options</li> <li>Double click on Accounts: Limit local account use of blank passwords to console login only.</li> <li>Select the radio button next to <strong>Enabled</strong> and click [OK]</li> </ul>